This vulnerability (CVE-2026-6372) in Plisio Accept Cryptocurrencies with Plisio is classified as CWE-862 (Missing Authorization). It allows exploitation due to improperly configured access control security levels, potentially enabling unauthorized users to perform actions that could alter system integrity. The affected product versions include all versions up to 2.0.5. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with no privileges required and no user interaction, impacting integrity but not confidentiality or availability. No patch or official remediation level has been disclosed by the vendor, and the product is not a cloud service, so remediation is the responsibility of the user or administrator.

The vulnerability can lead to unauthorized modification of data or system state (integrity impact) without requiring authentication or user interaction. Confidentiality and availability are not impacted according to the CVSS vector. This could allow attackers to manipulate cryptocurrency acceptance processes or related configurations, potentially causing financial or operational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should review and tighten access control configurations where possible to limit exposure. Monitor vendor channels for updates and apply patches promptly once released.