The Vchasno Kasa WordPress plugin contains a missing capability check in the mrkv_vchasno_kasa_wc_do_metabox_action() function. This flaw allows any visitor, even one who is not logged in, to request the creation of invoices for any order. As a result, attackers could generate fraudulent invoices, potentially leading to financial losses or the exposure of confidential order information.

The vulnerability exists in the bandido Vchasno Kasa Integration plugin for WordPress up to version 1.0.3, inclusive.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score is reported as below 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating that it is not widely exploited in the wild. Attackers can exploit the weakness remotely by sending crafted requests to the plugin’s endpoint, as the missing authorization check is performed server‑side.