What is the CVSS score of CVE-2026-12738?

CVE-2026-12738 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Easy Pay CVE-2026-12738

EUVD-2026-43151 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-h64r-hhm8-6c7c

WordPress Authentication Bypass Wordpress Plugin Wp Easy Pay Payment And Donation Form Builder For Square Saadiqbal

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable action handler, trivial exploitation at subscriber level, integrity-only impact limited to post status change; no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:59 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 4.3

DescriptionCVE.org

The WP Easy Pay - Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the status of arbitrary posts and pages to 'draft', effectively unpublishing arbitrary site content.

AnalysisAI

Authorization bypass in the WP Easy Pay WordPress plugin (versions ≤4.5.0) allows any authenticated WordPress user at subscriber level or above to set arbitrary posts and pages to 'draft', silently unpublishing site content without editorial authorization. The flaw stems from missing capability checks in the plugin's action handlers (wpep-setup.php), confirmed by Wordfence with direct source code references. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the low barrier to exploitation - any registered user qualifies - makes this a meaningful risk on sites with open user registration.

Technical ContextAI

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin registers WordPress AJAX or REST actions without verifying whether the calling user holds the capability required to change post status. The affected code is documented at wpep-setup.php lines 31, 1698, and 1703 in the 4.5.0 tag, visible via the WordPress plugin SVN trac browser. WordPress's authorization model relies on plugins explicitly calling current_user_can() or equivalent checks before performing privileged operations; this plugin skips that gate. The CPE string (cpe:2.3:a:saadiqbal:wp_easy_pay_-_payment_and_donation_form_builder_for_square) confirms the vendor is 'saadiqbal' and the plugin integrates Square payment and donation form functionality into WordPress. The subscriber role is WordPress's lowest authenticated role, assigned by default to anyone who registers an account.

RemediationAI

Update the WP Easy Pay plugin to the version released after 4.5.0 that incorporates SVN changeset 3593500; verify the specific patched version via the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2121d9fa-bab4-489d-89bc-07a8660bc3d1. If immediate update is not possible, the most effective compensating control is disabling public user registration under WordPress Settings > General ('Anyone can register'), which removes the low-privilege entry point required for exploitation - note this blocks legitimate self-registration as a side effect. Alternatively, administrators can audit current subscriber-level accounts and remove untrusted users, or use a firewall rule (e.g., Wordfence WAF) to block unauthenticated and low-privilege access to the specific AJAX/action endpoints exposed by wpep-setup.php lines 1698 and 1703. Simply deactivating the plugin eliminates the attack surface entirely if Square payment functionality is not critical.