The EPSS score of 0.00228 is misleading you — not because the math is wrong, but because EPSS measures automated exploitation probability in a context where that metric was never designed to matter. This is an unauthenticated access control flaw in a payment gateway. The attacker doesn't need credentials, and if they exploit it successfully, you're not dealing with a data leak — you're dealing with potential transaction manipulation, refund fraud, and PCI-DSS scope expansion that retroactively classifies your entire transaction history as cardholder data requiring forensic review.
The specific weakness here is a CWE-639 pattern: authorization bypass through a user-controlled key. Developers routinely conflate 'user has a WooCommerce session' with 'user is authorized for this specific transaction context.' That's not a resource problem — it's a threat model failure that recurs across payment plugins because the security-relevant assumptions never get documented. When someone patches it six months later, they patch the symptom (unauthorized refund access) without capturing the violated assumption, and the next developer inherits code with no annotation explaining why that check exists.
Evaluate your fix in 4.22.10 critically. If the patch checks 'does this refund belong to this order' rather than moving authorization into a capability-based check, expect a variant CVE within 18 months. Payment gateway patches routinely address the observed vector while leaving the architectural pattern intact — that's worse than doing nothing because it creates false confidence.
Check your plugin version, but also check what else is in there. Payment gateway plugins accumulate deprecated endpoints, superseded API routes, and 'temporarily disabled' transaction paths that never got removed. The WordPress ecosystem lags badly on updates — some installs are running older versions with partial patches applied but the underlying authorization flaw still present. The blast radius of a successful exploit includes your merchant's revenue stream: PCI-DSS violations trigger audit obligations, card brand fines, and in some processor agreements, immediate suspension of payment processing. That's not a technical impact metric. That's business continuity risk.