EUVD-2026-37903
GHSA-2g6j-493r-hmfj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CSRF intrinsically requires victim browser interaction (UI:R); the supplied UI:N contradicts CWE-352 mechanics and is corrected here.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery.
This issue affects WP EasyPay: from n/a through 4.4.0.
AnalysisAI
Cross-site request forgery in the WP EasyPay WordPress plugin (versions through 4.4.0) enables remote attackers to perform unauthorized administrative actions by tricking an authenticated WordPress administrator into visiting a maliciously crafted page. Missing or insufficient nonce verification on one or more plugin endpoints allows the attacker's forged request to be processed as a legitimate action using the victim's active session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a WordPress site administrator holds an active, authenticated session in their browser at the moment they visit the attacker-controlled page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) contains a likely scoring error: the UI:N (no user interaction) metric is mechanically inconsistent with a CSRF vulnerability, which by definition requires a victim to interact - visiting a malicious page or clicking a crafted link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a webpage containing a hidden HTML form or auto-submitting JavaScript that targets a vulnerable WP EasyPay admin endpoint. The attacker delivers the page URL to a WordPress site administrator via phishing email or social media; when the administrator loads the page while their WordPress session is active, the victim's browser automatically submits the forged request with their authenticated session cookies, causing the plugin to execute the action - such as modifying payment settings - without validating request origin. … |
| Remediation | Administrators should check the official WordPress Plugin Repository for a version of WP EasyPay above 4.4.0 and upgrade immediately, consulting the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-easy-pay/vulnerability/wordpress-wp-easypay-plugin-4-4-0-cross-site-request-forgery-csrf-vulnerability for the confirmed fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Easypay
View allThe WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, lea
The WP EasyPay - Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a mi
WP EasyPay versions up to 4.2.11 contain an authorization bypass that allows authenticated users to modify plugin settin
WP EasyPay plugin through version 4.3.0 exposes sensitive information in sent data, allowing unauthenticated remote atta
The WP EasyPay - Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to
Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay - Square for WordPress plugin <= 4.1 versions.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today