Book Previewer For Woocommerce EUVD-2026-20342

The CVSS score of 5.3 indicates moderate severity with network-based attack vector, low complexity, and no privilege requirements-suggesting an easily triggerable flaw. However, EPSS exploitation probability of 0.02% percentile (4th percentile) significantly dampens real-world risk, indicating very low likelihood of active exploitation. CISA SSVC framework assessment confirms no observed exploitation, though the impact is marked as 'partial' and the flaw is automatable, meaning once weaponized it could scale quickly. The confidentiality impact is limited (C:L) with no integrity or availability risk. Cross-referencing signals: the high CVSS vs. minimal EPSS discrepancy suggests this is a technically valid but contextually low-priority flaw-important to patch for WooCommerce sites handling sensitive book content, but not an urgent priority for organizations without this plugin or with limited book commerce operations. The broken access control class (CWE-862) ranks high in severity taxonomies, but exploitation requires the plugin to be actively used and improperly configured.

An unauthenticated attacker scans a WooCommerce site running Book Previewer for WooCommerce ≤1.0.6 and crafts a direct request (GET/POST) to the plugin's preview endpoint without authentication. Due to missing authorization checks, the plugin returns preview content that should be restricted to paying customers or administrators, allowing the attacker to read sensitive book excerpts, metadata, or cover images. No sophisticated tools or user interaction are required, making the exploit low-complexity and automatable at scale across vulnerable installations, though current public exploit code availability is not confirmed.