The Quick Paypal Payments plugin contains a missing CSRF check for state‑changing requests. This allows an attacker who tricks a logged‑in user into visiting a crafted URL to perform privileged PayPal payment actions on the user’s behalf. The issue aligns with CWE‑352 and can compromise the integrity of the site’s payment operations.

WordPress sites that use fullworks Quick Paypal Payments plugin version 5.7.46 or older are vulnerable. Any installation that has the plugin active and a user authenticated can be targeted. The problem exists across all browsers and platforms that the plugin supports.

The CVSS score of 4.3 indicates moderate risk, and an EPSS score of less than 1 % means exploitation is uncommon but still possible. Because the most likely attack vector is a simple HTTP request from an external site, an attacker can exploit the flaw without any special privileges. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation at the time of this analysis.