The vulnerability identified as CVE-2025-62754 affects the Payment Gateway bKash for WC plugin by Kapil Paul, specifically versions up to 3.1.0. It is classified as a Missing Authorization issue, meaning that the plugin fails to properly enforce access control checks, allowing unauthorized users to perform certain actions. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, impacting integrity but not confidentiality or availability.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the affected payment gateway plugin, potentially altering data or operations related to payment processing. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates and apply any official fixes once released. Until then, restrict access to the plugin's administrative interfaces and review access control configurations to minimize exposure.