The ViaBill for WooCommerce plugin up to version 1.1.53 contains a missing authorization vulnerability that allows an attacker to modify the plugin’s configuration settings without proper authentication. Classified as CWE‑862, the flaw can alter payment processing parameters and the way the plugin interacts with WordPress, potentially compromising transaction integrity and exposing sensitive financial data.

All WordPress installations that use the ViaBill – WooCommerce plugin version 1.1.53 or earlier are affected. Any site relying on this plugin for payment handling is vulnerable to unauthorized configuration changes.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests low current exploit activity and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the plugin’s settings interface, which can be accessed by any authenticated user who has permission to view or edit the settings. Based on the description, it is inferred that such an attacker could alter configuration values, potentially enabling unauthorized payment routes or disabling security checks. Although exploitation probability is low at present, the ability to change core settings increases risk until the plugin is updated or otherwise mitigated.