The vulnerability is a missing authorization flaw that allows an attacker to use restricted functionality of the Pay for Payment for WooCommerce extension without proper privileges. Because the plugin fails to enforce role checks, an unauthorised user could potentially alter payment settings, view privileged data, or otherwise manipulate store operations. This issuse is classified as CWE-862, an instance of broken access control that directly compromises the integrity of the site environment.

The affected product is the Pay for Payment for WooCommerce extension developed by Karolína Vyskočilová. All releases up to and including version 3.0.1 are vulnerable, while the fix is delivered in version later.

With a CVSS score of 5.3 the vulnerability is considered moderate. No EPSS score is publicly available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploit has been reported. The plugin operates within WordPress, so an attacker would likely exploit the flaw remotely by crafting HTTP requests that target the plugin’s administrative endpoints, bypassing typical WooCommerce capability checks. The lack of an EPSS figure does not negate the risk; the vulnerability remains actionable.