rootpwn

medium · CVSS v3 5.3

CVE-2026-96449

WPExperts WP EasyPay plugin has a missing authorization flaw that allows attackers to bypass access controls. The vulnerability can be explo

Overview

WPExperts WP EasyPay plugin has a missing authorization flaw that allows attackers to bypass access controls. The vulnerability can be exploited on any site running versions up to 4.5.4. It enables unauthorized users to modify payment settings and potentially access sensitive data.

Description

Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.

Impact

The flaw compromises confidentiality and integrity of payment configuration data, and can lead to unauthorized financial transactions. Administrators and site owners are directly impacted, as attackers can alter payment processing rules. Customers may also be exposed to data leakage.

Remediation

Update WP EasyPay to the latest version (4.5.5 or newer) which includes proper access control checks. If an update is not immediately possible, restrict the plugin’s capabilities to only trusted administrators and disable any unused payment methods. Verify role permissions and audit logs for suspicious activity.

Risk context

The CVSS v3 score of 5.3 indicates a medium risk. No EPSS data is available, so the urgency remains moderate. Defenders should treat this as a standard patching priority.

Affected products

  • WPExperts WP EasyPay

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

WordPress plugin missing-authorization access-control medium payment WPExperts

← All CVEs

Related CVEs

medium

CVE-2026-106031

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.

View analysis

medium

CVE-2026-96806

Apache Airflow's Keycloak authentication manager fails to terminate sessions on logout, issuing a new token after revocation. This allows anyone who later accesses the same browser to continue acting as the logged-out user. The flaw affects deployments using the Keycloak auth manager.

View analysis

medium

CVE-2024-58397

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or leaking adjacent heap memory into chapter titles.

View analysis

medium

CVE-2026-111269

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

View analysis