An unauthenticated broken access control vulnerability in Xendit Payment plugin versions 7.1.0 and earlier enables unauthorized access and potential data integrity risks.

This is a missing authorization vulnerability (CWE-862) that allows an unauthenticated attacker to perform sensitive actions within the plugin. The lack of proper capability checks permits unauthorized interaction with the plugin functionality.

The CVSS score of 7.5 reflects the high risk posed by this vulnerability, as it allows unauthenticated users to bypass critical access controls. This could lead to unauthorized modification of payment configurations, transaction interference, or other malicious activities that disrupt business operations and compromise the security of payment processing workflows.

Immediate Action: Update the Xendit Payment plugin to version 7.1.1 or later immediately to remediate the access control flaw.

Proactive Monitoring: Review audit logs for unauthorized plugin configuration changes or suspicious administrative activity linked to the Xendit Payment interface.

Compensating Controls: If an immediate update is not possible, consider temporarily deactivating the plugin and implementing a Web Application Firewall (WAF) rule to block unauthorized traffic targeting the plugin's endpoints.

Public Exploit Available: No

Given the potential for unauthorized administrative actions, organizations utilizing the Xendit Payment plugin must prioritize updating to version 7.1.1. Failure to patch leaves the payment integration exposed to unauthenticated manipulation.