Technical impact
Missing Authorization in the Payment Gateway Pix For GiveWP plugin allows attackers to bypass intended access controls, potentially granting them unauthorized access to restricted areas or data. The vulnerability stems from incorrectly configured access control security levels (CWE-862), which could let attackers retrieve or manipulate sensitive information within the WordPress site. No further exploitation details are provided in the official description, but the vulnerability permits unauthorized operations that would normally require higher privileges.
Affected Systems
The affected product is the linknacional Payment Gateway Pix For GiveWP WordPress plugin, version 2.2.3 and earlier. The vulnerability impacts all installations using any version through 2.2.3, as indicated by the CNA's affected version data.
Risk and Exploitability
According to the CVSS score of 5.3, this defines a medium severity vulnerability. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and it is not listed in CISA's KEV catalog. Exploitability likely requires a user to access the WordPress admin area or an exposed plugin endpoint; thus, the attack vector is inferred to be remote via web interface, but the exact vector is not explicitly defined in the provided data.
