WPExperts WP EasyPay, a WordPress payment plugin, contains a missing authorization check that enables any user who can reach the plugin’s endpoints to invoke restricted features without proper credentials. This broken access control flaw allows the attacker to view, modify, or delete sensitive transaction data, compromising both confidentiality and integrity of payment information. The vulnerability is formally classified under CWE-862 as a missing authorization issue.

The vulnerability affects the WPExperts WP EasyPay plugin for WordPress from any version up to and including 4.5.4. Any WordPress site that has not upgraded beyond 4.5.4 is potentially exposed. The affected product is the WP EasyPay plugin, operated by the vendor WPExperts.

With a CVSS score of 5.3 the flaw poses moderate risk, and its EPSS score is reported as less than 1 percent, indicating a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web requests to the plugin’s exposed endpoints; because the authorization check is missing the flaw can be triggered remotely over HTTP/HTTPS. Whether an attacker needs to be authenticated depends on how the plugin is configured, but the missing guard suggests no credentials may be required to exercise the limited access rights.