WP EasyPay CVE-2026-39734

Affects WP EasyPay (WordPress plugin by saad_iqbal) version 4.5.4 and earlier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated with no user interaction against a reachable plugin endpoint. The precise trigger - the specific vulnerable parameter, endpoint, and which files can be traversed to - is not described in the available sources, so the exact request syntax is unverified. Limiting factors: the site must run the vulnerable plugin at version <= 4.5.4 with its affected endpoint reachable, and impact is confined to confidentiality (file read); there is no integrity or availability impact and no path to code execution from this flaw alone.

Signals are moderately aligned but thin. The CVSS 3.1 base score of 7.5 reflects a network vector (AV:N), low complexity (AC:L) and no privileges or user interaction (PR:N/UI:N), with impact limited strictly to confidentiality (C:H/I:N/A:N) - consistent with an unauthenticated path traversal (CWE-35) that discloses file contents rather than enabling code execution or tampering. No EPSS probability is supplied, so likelihood of exploitation cannot be quantified. The vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. The only reference is the Patchstack vulnerability-database advisory (the original reporter), which is an advisory entry, not verified working exploit code. The vuln.today decision label is 'this_week' - a prompt but non-emergency priority. Net: this is a credible, easily reachable unauthenticated information-disclosure flaw, but its real-world urgency is tempered by a low real-world footprint and no confirmed exploitation. Treat as a genuine fix-this-week item for sites running the plugin, not a drop-everything emergency. Key missing data: no EPSS, no independent PoC, and the description does not name the exact vulnerable parameter or which files are reachable.

A remote, unauthenticated attacker sends a crafted HTTP request to a WP EasyPay endpoint on a WordPress site running version 4.5.4 or earlier, manipulating a path parameter to escape the intended directory and read arbitrary server-side files (e.g. wp-config.php or other sensitive content). Because no authentication or user interaction is required and complexity is low, the request can be issued directly against a default-reachable endpoint. No verified working exploit code is identified; only the Patchstack advisory exists.