The vulnerability is a broken access control where the PlanetStudio Payment Gateway plugin implements incorrectly configured security levels. This flaw allows an attacker to perform operations that should be restricted to privileged users, potentially manipulating payment gateway settings or accessing sensitive transaction data. The security weakness enumerated in the advisory is CWE-862 and results in an elevation of privilege within the WordPress site.

The affected product is the PlanetStudio Payment Gateway plugin. All installed versions from the initial release up through 1.3.3 are vulnerable. This includes any installation of the plugin before the 1.3.4 release.

The CVSS score of 5.3 indicates a medium impact. The EPSS score is reported to be less than 1%, suggesting a very low probability of exploitation in the field. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed deployments of exploited code. Attackers would need to target the plugin’s web endpoints, and the weakness likely requires some user interaction or a compromised account to exploit most effectively.