The Payment Plugins for PayPal WooCommerce WordPress plugin versions prior to 2.0.20 lack proper authorization enforcement on a REST API endpoint. This missing authorization (CWE-862) permits unauthenticated attackers to bypass payment mechanisms, potentially causing unauthorized payment transactions. The vulnerability is categorized under CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

An attacker can exploit this vulnerability to bypass payment authorization controls, potentially causing unauthorized payment actions or manipulation of payment processes. There is no impact on confidentiality or availability, but integrity is affected due to unauthorized modification or bypass of payment controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates and apply any official patches once available. Until then, restrict access to the affected REST endpoints if possible and consider additional access controls or monitoring to detect unauthorized usage.