The vulnerability stems from a missing authorization check in the YITH PayPal Express Checkout for WooCommerce plugin, enabling an attacker to exploit incorrectly configured access control security levels. The flaw permits unauthorized users to perform privileged actions, such as modifying plugin settings or payment configuration, potentially leading to unauthorized financial transactions. This weakness is categorized as CWE‑862.

WordPress sites running the YITH PayPal Express Checkout for WooCommerce plugin version 1.61.0 or earlier are affected. The vendor is YITH, and the plugin should be updated to at least 1.62.0 to remediate the flaw.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is through an authenticated user already present in the WordPress environment who can access the plugin administration interface; such a user can then manipulate payment settings beyond their intended permissions. Because the vulnerability hinges on broken access control, once exploited an attacker can alter payment flow or redirect transactions, compromising the integrity of the site’s commerce operations.