The vulnerability is an Insecure Direct Object Reference that allows an attacker to bypass authorization controls by supplying a user‑controlled key. This can lead to unauthorized retrieval or modification of sensitive data that belongs to other users. The weakness is classified as CWE‑639 and poses a moderate risk of privilege escalation within the affected application.

WordPress Pay with Vipps for WooCommerce plugins developed by WP Hosting AS are affected. All versions up through 6.2.4 (inclusive) are vulnerable and should be considered at risk. Versions 6.2.5 and later contain the remediation.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available. The vulnerability is not listed in CISA KEV. The likely attack vector is an attacker sending crafted HTTP requests that include a user‑controlled identifier to access resources belonging to other users; authenticated sessions may be required to exploit the IDOR. The CVE description confirms that access control is incorrectly configured, enabling the bypass without additional privileges.