PlanetStudio Payment Gateway CVE-2026-110362

Exploitation requires that the vulnerable PlanetStudio Payment Gateway plugin (version 1.3.3 or earlier) be installed and active on an internet-reachable WordPress site; the affected plugin endpoint must be accessible, which per PR:N and UI:N needs no authentication and no victim interaction. The practical limiters are the plugin's small deployment footprint and the LOW, integrity-only impact (C:N/A:N) - an attacker gains an unauthorized action or limited data modification, not credential theft, data exfiltration, or site takeover. No non-default configuration is indicated as a prerequisite in the available data.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) describes a remotely reachable, unauthenticated, low-complexity Missing Authorization flaw (CWE-862) whose only impact is a LOW integrity effect - no confidentiality loss and no availability impact. In practice that typically means an attacker can invoke a protected action or modify limited plugin state they should not be able to reach, rather than achieving data theft or full compromise. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. No SSVC decision data was provided. Signals are internally consistent (network vector matches a WordPress plugin reachable over HTTP, PR:N matches the 'Authentication Bypass'/'Broken Access Control' characterization), so no contradictions need flagging - the main limiter on real-world risk is the narrow integrity-only impact and the apparently small deployment footprint of this specific plugin.

An unauthenticated attacker sends a crafted HTTP request directly to an access-control-deficient endpoint of the PlanetStudio Payment Gateway plugin (versions up to and including 1.3.3) on a target WordPress site, invoking a function that should require authorization. Because the authorization check is missing or misconfigured, the action succeeds and the attacker modifies limited plugin state or data (consistent with the LOW integrity, no-confidentiality, no-availability CVSS impact). No public proof-of-concept is referenced, and given AC:L the request requires no special timing or preconditions.