The vulnerability is an authentication bypass that lets an attacker use an alternate path or channel to trigger the password recovery process without proper authentication. By exploiting this flaw, an attacker can reset a WordPress user’s password, gain the same level of access as that user, and potentially compromise the entire site. The weakness maps to CWE‑288 Authentication Bypass.

ThemeHigh’s Stripe Payment Gateway for WooCommerce plugin, versions from the initial release through 5.0.7, is affected. Any WordPress site that has this plugin installed within that version range is vulnerable.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through the web interface via the password recovery endpoint, which is reachable by unauthenticated users; an attacker could exploit it remotely without needing credentials. Because the flaw allows password reset for any account, the potential impact is full access to authenticated accounts and the site.