The Peach Payments Gateway WordPress plugin (wc-peach-payments-gateway) suffers from a missing authorization vulnerability that arises from incorrectly configured access control security levels. This flaw could allow unauthorized users to perform actions that should require proper permissions. The affected versions include all versions up to and including 4.0.2. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No vendor advisory or patch information is available, and no known exploits have been reported.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the Peach Payments Gateway plugin, potentially leading to integrity and availability impacts. Confidentiality is not affected. The medium severity score reflects the potential for disruption or manipulation of payment gateway operations without requiring authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Peach Payments and consider restricting access to the plugin's administrative interfaces as a temporary measure.