The Eupago Gateway For Woocommerce plugin contains a missing authorization check (CWE-862) that allows an attacker to perform actions that should be restricted within a WordPress store. This flaw enables unauthorized modification of payment gateway settings, the initiation of fraudulent transactions, and other privileged operations, jeopardizing the integrity of the e‑commerce platform and eroding customer trust.

Any WordPress installation running the Eupago Gateway For Woocommerce plugin version 4.7.1 or earlier is affected. The vulnerability spans all releases from the first available version through the specified upper bound, meaning a large number of sites may still use a vulnerable version if they have not upgraded.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild at the time of this analysis. The issue is not listed in CISA’s KEV catalog and no documented exploits exist. The likely attack vector is through the plugin’s web interface, requiring the attacker to locate the missing authorization path and trigger the unintended action. While the risk is moderate, prompt remediation is advised to prevent potential misuse.