For CVE-2026-66431, the CVSS 7.5 and EPSS 0.00246 disconnect is real but requires more nuanced interpretation than a simple severity ranking. The vulnerability is an unauthenticated broken access control flaw in a WooCommerce Bitcoin Lightning payment plugin — the 'unauthenticated' qualifier is technically accurate and severe, but the actual risk depends on what an unauthenticated actor can do: modify payment states, access transaction data, manipulate Lightning invoice generation, or redirect funds. That capability boundary matters more than the access-control classification alone.
The low EPSS likely reflects limited plugin adoption rather than exploit complexity. This creates a distorted threat picture: mass exploitation campaigns are unlikely against a niche Lightning Network plugin, but targeted attacks against high-value merchants running this version are plausible. The 'unauthenticated' descriptor means anyone can probe the function — but 'exploitable by anyone' and 'exploited by anyone' are different questions. For payment plugins serving merchants with significant Bitcoin Lightning volume, attackers optimize for high-value targets rather than broad scanning.
The payment context raises the floor regardless of adoption statistics. Even a low-probability exploit targeting financial transactions warrants different treatment than an equivalent flaw in non-monetary software. The WooCommerce payment plugin ecosystem has a documented pattern of authorization failures — developers juggling Bitcoin transaction semantics, invoice state machines, and WooCommerce hooks operate under cognitive load where authorization boundary violations become predictable, not exceptional.
What warrants more scrutiny than the CVE severity is the remediation timeline. Small-team plugins with minimal corporate backing often have extended exposure windows — patch publication and patch deployment can span months or longer. The CVSS captures a moment-in-time severity; the actual risk is a function of how long this remains exploitable post-patch. For a plugin integrating a third-party Bitcoin Lightning library that evolves independently, the attack surface can grow as dependencies decay even after a fix is available. Prioritize verifying patch deployment status across your environment rather than treating this as a generic access-control vulnerability requiring only standard vulnerability management.