Atomic Edge analysis of CVE-2026-27374 (metadata-based):
The WooCommerce Order Details plugin for WordPress contains a missing authorization vulnerability in versions up to and including 3.1. This flaw permits unauthenticated attackers to execute a privileged action intended only for authorized users. The CVSS score of 5.3 (Medium) reflects a network-accessible attack with low complexity that impacts integrity but not confidentiality or availability.

CWE-862, Missing Authorization, indicates the plugin fails to verify a user’s capability before executing a sensitive function. Atomic Edge research infers the vulnerable component is likely an AJAX handler or admin POST endpoint registered via `add_action(‘wp_ajax_…’)` or `add_action(‘admin_post_…’)` without a corresponding capability check using `current_user_can()`. The description confirms the absence of a capability check but does not specify the exact function. The vulnerability exists because the plugin trusts the action hook’s caller without validating permissions.

Exploitation involves sending a crafted HTTP request to the vulnerable endpoint. Based on WordPress plugin patterns, the likely attack vector is the WordPress AJAX handler (`/wp-admin/admin-ajax.php`) with an `action` parameter corresponding to the plugin’s registered hook. A plausible endpoint is `/wp-admin/admin-ajax.php` with `action=woocommerce_order_details_action`. The attacker sends a POST request with parameters required by the underlying function, such as order IDs or data manipulation commands. No authentication cookies or nonces are required.

Remediation requires adding a proper capability check before the sensitive function executes. The fix should verify the current user possesses a required capability, such as `manage_woocommerce` or `edit_shop_orders`, using `current_user_can()`. If the endpoint is intended for administrators, the check must also confirm the user is logged in. The patched code must validate both authentication and authorization. WordPress nonce verification should also be added to prevent CSRF, but the primary flaw is the missing capability check.

Successful exploitation allows unauthenticated attackers to perform unauthorized actions. The exact impact depends on the vulnerable function’s purpose. Given the plugin’s name and WooCommerce context, likely actions include viewing, modifying, or deleting order details. This could lead to data tampering, privacy violations, or disruption of store operations. The integrity impact (I:L) in the CVSS vector confirms unauthorized modification of data.