Technical impact
The vulnerability is a broken authentication flaw identified as CWE‑288 in the CorvusPay WooCommerce Payment Gateway plugin for WordPress versions 2.7.4 and earlier. It allows an unauthorized user to authenticate without valid credentials. The exact impact on the payment system is not described in the advisory, but as unauthorized access is possible it is inferred that an attacker could perform actions normally restricted to authenticated users.
Affected Systems
The issue affects the CorvusPay WooCommerce Payment Gateway plugin for WordPress, versions up to and including 2.7.4. Any installation of this plugin in those versions is vulnerable, regardless of the WordPress version, until the plugin is upgraded to 2.7.5 or newer.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity. The plugin is used in a web‑based WordPress site, so exploitation would occur over the web; this is inferred from the plugin's operating context. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but authentication bypass vulnerabilities are generally considered high risk. The vulnerability is not listed in the CISA KEV catalog. If exploited, the attacker would gain unauthenticated control over the payment gateway; the specific consequences beyond this are not detailed but could potentially lead to financial or reputational harm. These statements are inferred from the nature of the flaw.
