The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control level for the MyCryptoCheckout plugin. An unauthenticated or minimally privileged user can reach and modify sensitive administrative functions of the plugin, potentially exposing confidential transaction data or manipulating the checkout configuration. The weakness is identified as CWE-862, addressing improper access control.

WordPress sites that have installed the MyCryptoCheckout plugin version 2.161 or earlier are impacted. The affected vendor is edward_plainview and the product is the MyCryptoCheckout plugin for WordPress. The vulnerability applies to all deployments of these versions without any custom hardening applied.

The CVSS score of 7.5 classifies the issue as high severity. EPSS information is not available, so the current exploitation likelihood cannot be quantified, but the vulnerability remains enabled in all affected installations. The vulnerability is not listed in CISA KEV, yet its high score and the nature of credentialless privileged access mean that a determined attacker with network or endpoint exposure to the target site could abuse the flaw. The likely attack vector involves direct HTTP requests to administrative endpoints that are not protected by proper role checks.