Missing authorization checks in the Payday plugin allow an attacker to perform privileged operations within a WordPress site without proper authentication. The vulnerability is classified as a broken access control flaw, which can potentially lead to unauthorized data modification, page injection, or other privileged actions, depending on the plugin's exposed functionality.

All releases of the Payday WordPress plugin from gunnarpayday, up to and including version 3.3.18, are affected. The vulnerability exists in every release that has not addressed the access control issue and is present in every environment where the plugin is installed and accessible.

The CVSS base score of 5.8 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests low overall exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog, which implies there are no widespread, publicly known attacks targeting this flaw. The likely exploit path requires access to the WordPress administrative interface or a user account with sufficient privileges, and the failure originates from the plugin’s incorrect configuration of access control security levels. Despite the low exploitation likelihood, the flaw can be used for privilege escalation or data tampering within the affected site.