Missing authorization in the Noor Alam Checkout for PayPal WordPress plugin enables an attacker to abuse incorrectly configured access control levels, allowing unauthorized actions such as viewing or modifying checkout settings. This vulnerability is classified as a broken access control weakness (CWE-862) and can lead to confidentiality, integrity, or availability impact on the e‑commerce site. It is not a remote code execution flaw but provides an attacker with elevated privileges beyond what is intended.

Vulnerable systems run the Noor Alam Checkout for PayPal WordPress plugin version 1.0.46 or older. No specific sub‑versions are excluded; the entire range from the first release up to and including 1.0.46 is affected. Only WordPress installations using this plugin are impacted.

The CVSS base score is 5.3, indicating moderate severity. EPSS is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers could potentially exploit the issue by sending specially crafted requests to plugin endpoints that lack proper authorization checks. Because the flaw originates from missing access control, it is likely limited to users who can reach the plugin’s administration pages but can bypass the intended permission model.