CVE-2025-47526

The GS Variation Swatches for WooCommerce plugin suffers from a missing authorization vulnerability that allows incorrect access control security levels to be exploited. The plugin lacks proper authorization checks on certain functions, enabling unauthenticated or low-privileged users to perform actions intended for higher-privileged roles [1].

Attackers can exploit this vulnerability without requiring authentication by sending crafted requests to affected endpoints. This vulnerability is known to be used in mass-exploit campaigns, where attackers target thousands of websites regardless of their size or popularity [1].

Successful exploitation could allow an attacker to modify product variation settings, access sensitive data, or execute other unauthorized actions within the WooCommerce environment. The impact is considered medium severity with a CVSS score of 5.4 [1].

The vulnerability has been patched in version 3.0.5 of the plugin. Users are strongly advised to update to this version or later to mitigate the risk. For sites unable to update immediately, consulting a web developer or hosting provider for assistance is recommended [1].