The vulnerability is a missing authorization flaw that allows attackers to bypass access controls in the yoomoney ЮKassa для WooCommerce WordPress plugin. Because the plugin fails to validate user permissions before granting access to sensitive administrative functions, an attacker could potentially read or modify configuration settings and obtain payment data. This weakness is classified as CWE-862 and results in unauthorized access to plugin resources, potentially exposing payment information to malicious actors.

Affected systems include any WordPress site utilizing the yoomoney ЮKassa для WooCommerce plugin. The issue applies to all released versions from the first build through version 2.17.3. Site administrators should check whether their installation leverages any of these releases.

The CVSS score of 5.3 indicates moderate severity, yet the lack of an EPSS score leaves the precise likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented large-scale exploitation as of now. The likely attack vector is remote via the web interface, though the description does not explicitly state it; based on typical plugin behavior, an attacker would need authenticated access to reach the vulnerable functionality, implying that the flaw could be exploited by users with elevated privileges who intend to misuse the plugin or by attackers who compromise an administrative account.