The vulnerability is an unauthenticated broken access control in PayPlug for WooCommerce (Official) versions up to 3.1.0. Because the plugin lacks proper permission checks for its API endpoints, an attacker who can send HTTP requests to the site can perform privileged actions normally reserved for users with higher roles. This flaw allows unauthorized creation, modification, or deletion of orders and could expose sensitive customer information. The flaw is classified as CWE-862, broken access control.

WordPress sites that use the PayPlug for WooCommerce (Official) plugin with version 3.1.0 or earlier. The plugin is a payment add‑on for WooCommerce, so any WooCommerce store that has not yet upgraded beyond 3.1.0 is impacted.

The CVSS score of 7.5 indicates high severity, and the vulnerability is exploitable without authentication, making it readily usable by remote attackers. The EPSS score of < 1% shows a low probability of exploitation in the near term, and the lack of inclusion in the CISA KEV catalog suggests no known, widespread exploitation yet. An attacker can target the vulnerable endpoints directly, bypassing authentication controls, making the risk significant for any exposed store.