Missing authorization checks in the WordPress Official Integration for Billingo plugin allow an authenticated user to elevate privileges. A user with basic access can exploit vulnerable endpoints or actions, gaining administrative rights to modify billing records, manage users, or alter financial data. The flaw is a classic missing privilege check (CWE‑862) and could lead to unauthorized manipulation of sensitive financial information.

Vendors affected are Billingo for the Official Integration for Billingo plugin on WordPress. The vulnerability exists in all releases from the initial launch through version 4.3.0. No other product versions are impacted.

With a CVSS score of 7.2 and an EPSS of less than 1 %, the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack surface is remote via the WordPress web interface; an attacker who has authenticated as a normal user could manipulate privileges to reach administrative functionality. The potential consequences include full control over billing operations and disclosure of financial data. The risk remains moderate until a patch is applied.