APIExperts Square EUVD-2026-109735

Exploitation requires that a target WordPress site have the APIExperts Square for WooCommerce (woosquare) plugin installed and active at version 4.7.5 or earlier; the flaw is a missing authorization check (CWE-862), so per the CVSS vector it needs no authentication, no privileges, and no user interaction (PR:N/UI:N), and works against default configurations reachable over the network (AV:N/AC:L). The practical limiting factors are the plugin's modest deployment footprint and the integrity-only, partial impact (C:N/A:N) - the specific protected function or data affected is not described in the available sources, so the concrete action an attacker gains is unverified.

This is a medium-severity (CVSS 5.3) missing authorization flaw (CWE-862) in the APIExperts Square for WooCommerce (woosquare) WordPress plugin. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-reachable, low-complexity exploitation with no privileges or user interaction required (PR:N = unauthenticated), but impact is limited to a partial integrity effect only - no confidentiality (C:N) and no availability (A:N) impact. All other exploitation signals are notably weak or absent: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no working proof-of-concept is supplied - the only reference is a Patchstack database entry (advisory metadata), not exploit code. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a real-but-non-urgent issue. In short, this is a legitimate authorization gap worth patching on a normal cadence rather than a high-priority emergency; the unauthenticated network vector keeps it from being dismissible, but the integrity-only, partial impact and absence of any active-exploitation or PoC signal place it well below critical. No signals are directly conflicting; the main gap is that the exact unauthorized action enabled is not described in the sources.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running APIExperts Square for WooCommerce (≤4.7.5) that invokes a plugin function lacking a proper authorization/capability check, allowing the attacker to perform a restricted action or modify data they should not be able to. The CVSS vector indicates this requires no authentication, no user interaction, and low attack complexity, but the impact is limited to partial integrity (C:N/A:N). No public exploit code is identified; only a Patchstack advisory reference exists.