EUVD-2026-57869
GHSA-wgmv-vvvj-jcfh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via standard HTTP, low complexity; subscriber-level authentication required (PR:L); confidentiality impact is high with no integrity or availability consequence applicable.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.
AnalysisAI
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Technical ContextAI
Payment Forms for Paystack is a WordPress plugin developed by kendysond (CPE: cpe:2.3:a:kendysond:payment_forms_for_paystack:*:*:*:*:*:*:*:*) that integrates the Paystack payment gateway into WordPress sites, enabling merchants to collect payments via embedded forms. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a failure to enforce role-based access controls on data-retrieval operations, allowing lower-privileged principals to access information scoped to higher-privilege roles such as shop managers or administrators. In WordPress plugin implementations this commonly manifests as REST API endpoints, wp-admin AJAX handlers, or shortcode callbacks that return subscriber transaction records, form submission payloads, or Paystack API configuration data without validating that the requesting user possesses the required WordPress capability (e.g., manage_options or edit_posts). The CVSS vector AV:N/PR:L confirms the exposure is reachable over the network by any authenticated subscriber without additional configuration prerequisites.
RemediationAI
Update the Payment Forms for Paystack WordPress plugin to a version beyond 4.0.5 as soon as a patched release is confirmed; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/payment-forms-for-paystack/vulnerability/wordpress-payment-forms-for-paystack-plugin-4-0-5-sensitive-data-exposure-vulnerability should be monitored for the exact fixed version number, which was not specified in the available intelligence data and cannot be independently confirmed at time of analysis. As a compensating control pending a patch, administrators should disable open user registration if it is not operationally required, which reduces the attacker pool to those who already possess or can obtain a valid WordPress account through other means - note this does not eliminate risk if subscriber registration is intentional for customers. Reviewing and removing any unnecessary subscriber accounts, and auditing plugin-specific AJAX actions and REST API routes for missing capability checks, will further reduce the exposure surface. A Web Application Firewall rule restricting access to plugin AJAX endpoints (admin-ajax.php with plugin-specific actions) from low-privilege sessions can serve as a temporary layer of defense, though precise endpoint names require source code inspection.
More in Payment Forms For Paystack
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today