Morning for WooCommerce EUVD-2026-92954

The only prerequisite is that the target WordPress site runs the Morning for WooCommerce (wc-gateway-greeninvoice) plugin at version 2.4.1 or earlier and exposes the vulnerable plugin endpoint to the network - the default configuration, since the flaw is reachable without authentication. There are no limiting factors from the CVSS vector: no user interaction (UI:N), no privileges (PR:N), and low complexity (AC:L). The practical limiting factor is deployment scope - this is a specialized Green Invoice / Morning invoicing gateway plugin, so exposure is confined to stores that specifically use that service rather than general WooCommerce installations. Impact is bounded to integrity (I:H) with no stated confidentiality or availability effect.

This is a CVSS 7.5 (High) flaw whose score is driven entirely by integrity impact (C:N/I:H/A:N) delivered over an unauthenticated network vector with low attack complexity (AV:N/AC:L/PR:N/UI:N). The CVSS vector is internally consistent with the description's 'Unauthenticated Broken Access Control' and CWE-862 (Missing Authorization): an attacker needs no credentials and no user interaction, which makes the vulnerability trivially reachable wherever the plugin is installed. However, the real-world signal set is thin: there is no EPSS score, no CISA KEV listing, and no public proof-of-concept referenced in the input, so there is no public exploit identified at time of analysis. The practical priority is therefore moderate rather than urgent - the barrier to exploitation is low, but exploitation volume is unproven and the product's deployment footprint is narrow (a specialized WooCommerce invoicing gateway). Note also that C:N/A:N means this is an integrity-only issue: an attacker can likely invoke or alter protected plugin functionality, but the vector does not claim data disclosure or denial of service. The absence of EPSS/KEV/POC is a data gap, not evidence of safety; it simply means no widespread automated exploitation has been observed yet.

An unauthenticated attacker sends a crafted HTTP request directly to a plugin endpoint (e.g. an AJAX or REST action) that fails to verify the caller's authorization, invoking a privileged invoicing/payment-gateway operation they should not have access to. Because no authentication or user interaction is required, this can be scripted against any reachable store running Morning for WooCommerce <= 2.4.1. No public exploit code is referenced, so an attacker would need to reverse-engineer the vulnerable endpoint from the plugin source.