Wp Express Checkout Accept Paypal Payments
Monthly
Unauthenticated attackers can modify arbitrary data or trigger protected operations in WordPress sites using the WP Express Checkout (Accept PayPal Payments) plugin versions up to and including 2.4.9, because the plugin fails to enforce authorization controls (CWE-862). The flaw is remotely exploitable without user interaction or credentials, with a CVSS 3.1 base score of 7.5 reflecting high integrity impact but no confidentiality or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a Patchstack advisory exists and administrators should treat the issue as high priority given the unauthenticated attack vector.
Unauthenticated attackers can modify arbitrary data or trigger protected operations in WordPress sites using the WP Express Checkout (Accept PayPal Payments) plugin versions up to and including 2.4.9, because the plugin fails to enforce authorization controls (CWE-862). The flaw is remotely exploitable without user interaction or credentials, with a CVSS 3.1 base score of 7.5 reflecting high integrity impact but no confidentiality or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a Patchstack advisory exists and administrators should treat the issue as high priority given the unauthenticated attack vector.