EUVD-2026-37903
GHSA-2g6j-493r-hmfj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CSRF intrinsically requires victim browser interaction (UI:R); the supplied UI:N contradicts CWE-352 mechanics and is corrected here.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery.
This issue affects WP EasyPay: from n/a through 4.4.0.
AnalysisAI
Cross-site request forgery in the WP EasyPay WordPress plugin (versions through 4.4.0) enables remote attackers to perform unauthorized administrative actions by tricking an authenticated WordPress administrator into visiting a maliciously crafted page. Missing or insufficient nonce verification on one or more plugin endpoints allows the attacker's forged request to be processed as a legitimate action using the victim's active session. No public exploit code and no CISA KEV listing are present at time of analysis.
Technical ContextAI
WP EasyPay is a WordPress payment plugin authored by Saad Iqbal (CPE: cpe:2.3:a:saad_iqbal:wp_easypay:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), a class of web application flaws where a forged, cross-origin HTTP request submitted from a victim's authenticated browser is accepted and processed as legitimate by the server. WordPress's security model requires plugins to validate cryptographic nonces (via wp_verify_nonce) on all state-changing requests; the root cause here is the absence or bypass of this check on one or more WP EasyPay plugin endpoints. The flaw was discovered and reported by Patchstack, a specialized WordPress security intelligence platform.
RemediationAI
Administrators should check the official WordPress Plugin Repository for a version of WP EasyPay above 4.4.0 and upgrade immediately, consulting the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-easy-pay/vulnerability/wordpress-wp-easypay-plugin-4-4-0-cross-site-request-forgery-csrf-vulnerability for the confirmed fixed release. No exact patched version was independently confirmed from the available data - treat any referenced version as unverified until confirmed against the plugin changelog. If an updated version is not yet available, deactivating the WP EasyPay plugin eliminates the attack surface at the cost of losing payment processing functionality. As a partial compensating control, a WAF rule blocking unsigned cross-origin POST submissions to the plugin's admin-ajax.php or admin endpoints may reduce but not eliminate risk, and may cause false positives on legitimate plugin interactions. Enforcing short admin session timeouts and training administrators to avoid clicking unsolicited links while logged into WordPress reduce exploitation likelihood without requiring plugin changes.
More in Wp Easypay
View allThe WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, lea
WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrar
The WP EasyPay - Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a mi
WP EasyPay versions up to 4.2.11 contain an authorization bypass that allows authenticated users to modify plugin settin
WP EasyPay plugin through version 4.3.0 exposes sensitive information in sent data, allowing unauthenticated remote atta
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access c
The WP EasyPay - Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to
Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay - Square for WordPress plugin <= 4.1 versions.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today