Autopay WordPress Plugin CVE-2026-73338

The Autopay WordPress plugin version 5.0.0 or earlier must be installed and active on the target WordPress site. No authentication is required of the attacker (PR:N per CVSS vector), but the victim must perform an active interaction such as clicking a crafted link (UI:R). The CVSS scope change (S:C) indicates the injected script executes in the victim's browser context rather than being confined to the server. Exploitation is limited by the UI:R requirement, which prevents fully automated, zero-click attacks - the attacker must successfully deliver and have a victim trigger the malicious link. The vulnerability is specific to the Autopay/Blue Media payment plugin and does not affect WordPress core or other plugins.

The CVSS score of 7.1 is driven primarily by the scope change (S:C) and network accessibility (AV:N/AC:L/PR:N), though the mandatory user interaction (UI:R) meaningfully constrains automated exploitation. No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog, meaning active in-the-wild exploitation is not confirmed. No POC code is referenced. Despite the absence of active exploitation signals, the combination of no authentication requirement and a payment-processing plugin context elevates practical risk - even a mid-sized municipal IT team in zabrze running a local e-commerce portal should treat this as urgent given the potential for session token theft from authenticated administrators or shoppers. The low individual impact ratings (C:L/I:L) reflect partial rather than total compromise per interaction, but chaining stolen admin sessions could escalate the impact significantly.

An attacker identifies a WordPress site running Autopay ≤ 5.0.0 and crafts a URL embedding a JavaScript payload in a vulnerable parameter handled by the plugin. The attacker distributes this URL to site administrators or authenticated customers via phishing email, targeting the payment workflow context to maximize the likelihood of interaction. When a victim loads the crafted URL, the plugin reflects the unsanitized payload into the HTML response and the victim's browser executes the script, potentially exfiltrating session cookies or WordPress nonces back to an attacker-controlled server. No confirmed POC is available, but the technique is standard for reflected XSS and requires no specialized tooling.