This vulnerability arises from missing authorization checks in the ZealousWeb 'Accept PayPal Payments using Contact Form 7' plugin, affecting versions up to 4.0.4. The issue allows unauthorized users to exploit improperly configured access control security levels, potentially leading to unauthorized modification or manipulation of payment-related functions. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

The vulnerability can allow an attacker to perform unauthorized actions that affect the integrity of the payment processing functionality within the plugin. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.