The PayPal Brasil para WooCommerce plugin does not verify that a user is authorized to call the 'bcdc_activation_update' action, enabling unauthenticated attackers to enable or disable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings. This removes PayPal from the checkout for all customers, disrupting payment flow and potentially causing revenue loss. The vulnerability does not expose transaction data directly, but it severely impacts the availability of the expected payment method.

WordPress sites that have installed the PayPal Brasil para WooCommerce plugin version 1.7.8 or earlier, released by Odefranca, are impacted. Sites using WooCommerce for payment processing that rely on the PayPal Brasil BCDC gateway will experience a loss of that payment option.

The CVSS score of 5.3 indicates medium severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this without authentication, most likely by triggering the vulnerable action through the WordPress admin interface or by accessing the action endpoint directly. The attack does not require code execution, but it grants the attacker control over gateway availability for all site visitors.