What is the CVSS score of CVE-2026-57808?

CVE-2026-57808 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

WP EasyPay CVE-2026-57808

Q: Which versions of WP EasyPay are affected by CVE-2026-57808?

WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862).

EUVD-2026-48183 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-9cmg-7p6p-5xq3

Authentication Bypass Wp Easypay WordPress Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

PR:L reflects the required subscriber account; I:H captures permanent arbitrary content deletion; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:07 vuln.today

DescriptionCVE.org

Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

AnalysisAI

WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862). The plugin fails to enforce capability verification before processing deletion requests, meaning any user holding the lowest standard WordPress role can permanently destroy posts, pages, or other content objects outside their normal permissions. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this straightforward to abuse on any site where user registration is open.

Technical ContextAI

WP EasyPay is a WordPress payment plugin developed by Saad Iqbal (CPE: cpe:2.3:a:saad_iqbal:wp_easypay:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization), a class of flaw where sensitive operations are executed without verifying that the requesting principal holds sufficient privilege. In WordPress, proper authorization is enforced via capability checks such as current_user_can() prior to any content mutation. The plugin omits this guard on its content deletion pathway, effectively allowing a subscriber - the lowest WordPress user role, typically granted on self-registration - to invoke functionality restricted by design to editors or administrators. The 'Authentication Bypass' tag in the source intelligence refers to the effective bypass of content-management authorization controls rather than a full authentication bypass.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-easy-pay/vulnerability/wordpress-wp-easypay-plugin-4-5-0-arbitrary-content-deletion-vulnerability and apply the latest available version of WP EasyPay from the WordPress plugin repository - an exact patched version number is not confirmed in the available data and must be verified there. If a patch is not yet available, the most effective compensating control is to disable open user registration under Settings > General in WordPress, preventing external parties from obtaining subscriber accounts; note this will prevent new users from self-registering. Alternatively, temporarily deactivating the WP EasyPay plugin removes the vulnerable code path entirely, at the cost of disabling payment functionality. Audit existing subscriber accounts for unexpected or untrusted users and revoke access where appropriate. Avoid granting subscriber-or-higher roles to untrusted users until patched.