The vulnerability is a missing authorization flaw that permits exploitation of incorrectly configured access controls within the Payment Plugins for PayPal WooCommerce plugin. Attackers could gain unauthorized access to privileged features exposed by the plugin, potentially allowing actions beyond the intended scope. This weakness is classified as CWE‑862, indicating that user or role checks are insufficient.

All WordPress sites that have installed Payment Plugins for PayPal WooCommerce version 2.0.13 or earlier are affected. The issue applies to every installation of the plugin within that version range, regardless of other configuration settings.

The CVSS score of 5.3 places the vulnerability in the medium severity range. With an EPSS score below 1% the likelihood of exploitation is considered low at present, and it is not listed in the CISA KEV catalog. The likely attack vector is through the web interface of the WordPress site; an attacker may need to authenticate or rely on a misconfigured role to leverage the flawed access control. The impact is limited to the capabilities exposed by the plugin but could compromise payment processing flows if successful.