Quick Paypal Payments EUVD-2026-98349

Exploitation requires only network reachability to a WordPress site running Quick Paypal Payments version n/a through 6.0.3; per CVSS AV:N/AC:L/PR:N/UI:N it is remote, unauthenticated, and needs no user interaction against default configurations. The practical limiting factors are scope and impact rather than access: the flaw yields only Low integrity impact (C:N/A:N), so an attacker can reach and invoke an access-controlled plugin function and alter bounded plugin/payment-related data, but cannot read confidential data or disrupt availability through this issue alone. Risk is further bounded by the plugin's modest deployment footprint and the requirement that the vulnerable endpoint be present (i.e., the plugin installed and active).

This is a moderate-risk, not high-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the impact is deliberately narrow: integrity is Low (I:L) with no confidentiality (C:N) or availability (A:N) effect, yielding a base score of 5.3 (Medium). As a CWE-862 Missing Authorization bug, it lets an unauthenticated actor reach a function that should be access-controlled, but the single Low integrity impact implies limited, bounded state changes rather than full compromise. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The combination of 'easy to reach' but 'low impact' is typical of Patchstack-reported WordPress plugin authorization gaps: worth patching, but not an emergency relative to RCE or auth-bypass-to-admin issues. Missing signals (EPSS, POC, KEV) mean exploitation likelihood is inferred only from the low barrier to reach the endpoint, not from observed activity.

An unauthenticated attacker identifies a WordPress site running Quick Paypal Payments <= 6.0.3 and sends a crafted HTTP request directly to a plugin endpoint (e.g. an AJAX or REST action) that fails to verify the caller's authorization. Because no authentication, user interaction, or special complexity is required (AV:N/AC:L/PR:N/UI:N), the attacker triggers a restricted action to alter plugin-managed data or settings. No public exploit code was identified at time of analysis, but the low complexity makes manual exploitation straightforward.