The vulnerability exists because the plugin's createPartialPayment and cancelPartialPayment functions lack a required capability check, allowing anyone without authentication to invoke these endpoints. This missing authorization permits the creation of arbitrary partial payments for any order and the cancellation of existing partial payments via simple ID enumeration, thereby enabling manipulation of order balances and potential financial fraud.

The affected product is the Link Invoice Payment for WooCommerce plugin for WordPress, any version up to and including 2.8.0.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Based on the missing capability check, an attacker can exploit the flaw by sending unauthenticated HTTP requests to the plugin’s partial payment endpoints, potentially enumerating payment IDs and creating or cancelling partial payments without credentials.