The Splitit plugin for WordPress contains missing capability checks within the splitIt-flexfields-payment-gateway.php file across all releases up to version 4.2.8. Authenticated users who hold the Subscriber role or any higher privilege can modify plugin configuration, for instance toggling the payment environment between sandbox and production, without proper authorization.

Affected systems are WordPress sites that have installed the Splitit installment‑payments plugin in a version 4.2.8 or earlier. The vulnerability resides in the plugin’s splitIt-flexfields-payment-gateway.php file and can be leveraged by users possessing authenticated access with Subscriber-level or greater permissions.

The CVSS score of 5.4 categorizes the flaw as moderate severity for unauthorized configuration changes. The EPSS rating of less than 1% indicates a very low exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated on the site with at least Subscriber privileges, making it a privilege‑related configuration issue rather than a remote code execution vector.