The vulnerability is a missing authorization flaw in the Yaad Sarig Payment Gateway For WC plugin that allows exploiting incorrectly configured access control security levels. It can be leveraged to gain unauthorized access to privileged settings, potentially altering payment gateway behavior. This issue falls under CWE-862, which concerns unauthorized access to protected resources or functions.

The vulnerability affects the WordPress Yaad Sarig Payment Gateway For WC plugin, version 2.2.11 and earlier. The affected product is the "Yaad Sarig Payment Gateway For WC" plugin distributed by yaadsarig, with all releases up to and including 2.2.11 being potentially impacted.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The plugin is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is through the WordPress site, where an attacker either has a low privileged role or unauthenticated access to invoke a protected functionality that should be restricted. The vulnerability permits the attacker to bypass intended access restrictions and manipulate payment gateway settings or related data.