This vulnerability is an unauthenticated broken access control flaw that allows an attacker to perform privileged actions without authentication. The weakness, identified as CWE-862, impacts the control decision mechanism within the WordPress WP Express Checkout (Accept PayPal Payments) plugin, enabling exploitation of protected functions. An attacker could potentially modify checkout settings, view sensitive transaction data, or alter payment processing behavior, compromising confidentiality, integrity, and availability of the e‑commerce workflow.

All installations of the WordPress WP Express Checkout (Accept PayPal Payments) plugin with versions up to and including 2.4.9 are affected. The plugin is distributed by mra13 under Team Tips and Tricks HQ. WordPress sites using these versions should verify the plugin version and apply the update to version 2.5.0 or later.

The CVSS score of 7.5 indicates a high severity with a substantial impact if exploited. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. However, the attack vector is likely web‑based and unauthenticated, meaning any user visiting a site with the vulnerable plugin could trigger the flaw. The risk remains moderate to high until the patch is applied, especially for sites that handle monetary transactions.