The vulnerability is a Cross‑Site Request Forgery (CWE‑352) that enables a malicious site to trigger unauthenticated WP‑admin actions through the YITH PayPal Express Checkout for WooCommerce plugin while a legitimate user is logged in. Attackers could use this flaw to change plugin settings, alter payment flows, or otherwise perform administrative operations without the victim’s consent. The impact is an unauthorized state change affecting the integrity of the WooCommerce checkout configuration.

Affects the YITHEMES YITH PayPal Express Checkout for WooCommerce WordPress plugin versions up to and including 1.49.0. Users running any earlier or later version are not impacted.

The CVSS v3.1 score is 4.3, indicating moderate severity, while the EPSS score of less than 1% suggests low exploit probability and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring a user to be authenticated to the WordPress admin and then visit a crafted malicious link or site that submits a forged request. Because the flaw manipulates state rather than bypassing authentication, the overall risk is moderate, but it remains a valid concern for sites with privileged admin users.