This vulnerability is an unauthenticated broken access control flaw in the Secure Card Gateway for ePay Paycenter (Piraeus Bank) WordPress plugin versions up to 1.0.32. The flaw resides in the plugin’s access control checks, allowing an attacker who is not logged in as a privileged user to access protected administrative functions of the payment gateway. Because the plugin handles card transaction processing, successful exploitation enables the attacker to view or modify transaction data, potentially exposing sensitive payment information or manipulating transaction records.

Affected systems are installations of the Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin from the vendor webhosting4ugr. All versions of the plugin up to and including 1.0.32 are impacted; newer versions (e.g., 1.0.33 and later) contain the fix.

The vulnerability has a CVSS score of 6.5, indicating a medium severity level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated, it can presumably be exploited by any HTTP request to the plugin’s endpoints, making it potentially widely available to attackers on the internet. The risk is elevated due to the nature of the data handled by the payment gateway, even though exploitation is not known to be widely used yet.