The EPSS score of 0.00242 will cause you to deprioritize this finding. Don't. The metric measures technical exploitability and current threat actor activity in isolation from business context—and broken access control in a payment plugin has a fundamentally different risk profile than the same flaw in a content management feature.
The CVSS 6.5 treats this as a generic medium-severity access control issue. But this plugin processes payments through WordPress forms. When authorization fails in a payment context, the attacker isn't reading someone else's draft post—they're manipulating transaction amounts, redirecting funds, or bypassing payment confirmation workflows. The exploit path isn't abstract data exposure; it's direct financial manipulation with real monetary consequences.
The 'unauthenticated' qualifier is the critical detail. No credential compromise or session hijacking is required. The attacker simply sends a properly crafted request to an endpoint that should have verified authorization but doesn't. In payment fraud, this creates an exploitation profile that differs radically from typical web vulnerabilities: minimal infrastructure needed, low forensic footprint, and conversion rates that make network intrusion operators envious.
The low EPSS likely reflects the plugin's install base or current detection gaps—not that exploitation is benign. Historical analogues tell the story: CVE-2021-43298 (WooCommerce Payments), CVE-2022-29163 (Easy Digital Downloads), CVE-2023-32243 (ASRet)—each scored medium, each deprioritized, each escalated to critical only after public exploitation. Payment access control bugs get weaponized within days of disclosure, not weeks.
Check whether you run this plugin. If you do, treat it as priority regardless of EPSS. The heuristic 'CVSS 6.5 equals moderate' fails when the affected component is payment infrastructure.