The vulnerability resides in the Payment Plugins for PayPal WooCommerce WordPress plugin, where a REST endpoint lacks proper authorization checks. This flaw allows an attacker to reuse an already completed PayPal order, effectively bypassing the normal payment flow and potentially causing unauthorized charges or refunds. The lack of authentication enables the attacker to manipulate the payment process and results in a loss of integrity for financial transactions. The weakness stems from improper access control, failure to check user role or permissions (CWE-639), and missing authorization for a privileged function (CWE-862).

All installations of the Payment Plugins for PayPal WooCommerce plugin with a version lower than 2.0.20 are vulnerable. The plugin is used within WordPress environments that integrate WooCommerce with PayPal, and any site running an outdated version of the plugin is at risk.

The CVSS score of 7.5 indicates a high severity vulnerability that can lead to loss of integrity and confidentiality of financial transactions. Because the attack vector is unauthenticated through a REST endpoint, no credentials or privileged access are required, making the exploitation path straightforward. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication checks and the potential impact on payment integrity create a high risk scenario that warrants urgent attention.