This vulnerability in Payment QR WooCommerce arises from missing authorization checks, which means that certain actions or resources may be accessible without proper permissions. The issue affects all versions up to and including 1.1.6. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits are currently in the wild, and no official patch or remediation guidance has been provided.

The vulnerability allows unauthorized users to perform actions that should require authorization, potentially leading to unauthorized modifications (integrity impact). There is no impact on confidentiality or availability. Since no exploits are known in the wild, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should review and tighten access control configurations where possible and monitor for updates from the vendor or security advisories.