This vulnerability involves missing authorization in the Scott Paterson Subscriptions & Memberships for PayPal plugin, allowing unauthorized users to access functionality due to improperly configured access control. It affects all versions up to 1.1.7. The CVSS 3.1 base score is 5.3 with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only. No official patch or vendor advisory is currently provided, and no exploits are known in the wild.

An attacker could exploit the missing authorization to gain unauthorized access to certain features or data within the affected plugin, potentially leading to limited confidentiality loss. There is no indication of impact on integrity or availability. The vulnerability does not require privileges or user interaction to exploit, increasing its risk profile. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's administrative or sensitive functions and monitor for updates from Scott Paterson regarding a security patch.