This vulnerability in Digages Direct Payments WP plugin (<= 1.3.2) arises from missing authorization controls, allowing users with limited privileges to exploit incorrectly configured access control security levels. The CVSS 3.1 score is 4.3 (medium), reflecting that the attack vector is network-based, with low attack complexity, requiring privileges, no user interaction, and impacts integrity only. No known exploits are reported in the wild. No patch or official remediation details are currently available.

The vulnerability allows unauthorized modification or manipulation of certain functions or data within the Direct Payments WP plugin by users with limited privileges. It does not affect confidentiality or availability. The impact is limited to integrity, potentially allowing unauthorized changes that could affect payment processing or related operations within the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to payment processing. Avoid granting unnecessary privileges to users interacting with the plugin.