The flaw is a missing authorization check in the Plisio Accept Cryptocurrencies with Plisio WordPress plugin that enables an attacker to bypass payment processing by exploiting improperly configured access control levels. Without proper authorization verification, the plugin can be instructed to accept cryptocurrency transactions that should be rejected, resulting in fraudulent payments and financial loss. This weakness is a classic example of CWE‑862, where the application fails to restrict access to privileged resources.

All WordPress sites that use the Plisio Accept Cryptocurrencies with Plisio plugin at versions through 2.0.5 are affected. The issue applies to every installation of the plugin up to and including 2.0.5; newer releases are not known to contain the vulnerability.

The vulnerability carries a CVSS score of 7.5, indicating high severity. The EPSS score is not yet available, so the exploitation probability cannot be quantified, but the lack of an authorization check means the flaw is exploitable by anyone who can submit payment requests to the plugin. Although the vulnerability is not listed in the CISA KEV catalog, the high impact and straightforward exploitation path warrant immediate security attention.