The vulnerability is a missing authorization check in the WP EasyPay plugin for WordPress, allowing an attacker to access or perform actions that should be restricted. It manifests as broken access control, a weakness identified as CWE‑862. This flaw means that users who should not have permission could potentially gain elevated privileges within the plugin environment, compromising the confidentiality or integrity of transactions handled by the plugin.

The affected system is the WordPress plugin WP EasyPay published by Saad Iqbal, specifically versions up to and including 4.2.11.

The available metrics indicate an EPSS score of less than 1 % and no listing in the CISA KEV catalog, suggesting a relatively low likelihood of widespread exploitation. The CVSS score of 5.4 points to a medium severity risk. However, the attack vector is not explicitly stated; based on the plugin nature, the likely exploitation path is via the WordPress web interface. The potential impact of unauthorized actions within the plugin warrants timely remediation.