Simple Payment CVE-2026-81767

No authentication is required - the CVSS vector PR:N/UI:N confirms remote unauthenticated exploitation with no user interaction against any WordPress site with the Simple Payment plugin installed and active. Attack complexity is Low (AC:L), meaning no race condition, special timing, or environmental prerequisite is needed. The sole limiting condition is that the target site must have the Simple Payment plugin by Yalla Ya! installed, activated, and running version 2.5.2 or earlier. Exploitation is bounded to integrity impact only (I:H, C:N, A:N); attackers cannot extract sensitive data or disrupt availability through this vulnerability alone.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates this is exploitable remotely with no prerequisites, making it straightforward to attempt at scale. However, several signals temper the urgency: no EPSS score is available in the provided data, the vulnerability has not been added to the CISA KEV catalog, and no public exploit or proof-of-concept code has been identified. The plugin is produced by a niche vendor (Yalla Ya!) and is unlikely to be deployed across a broad population of WordPress sites. Exploitation impact is limited strictly to data integrity - payment manipulation - with no confidentiality exposure. For sites actively using Simple Payment for e-commerce transactions, the risk is material and should be prioritized; for sites that have the plugin installed but inactive, risk is lower. SSVC analysis: exploitation status is 'none publicly known', automatable is 'yes' given AC:L/PR:N, technical impact is 'partial' (integrity only, no scope change) - pointing to a 'scheduled' remediation timeline for most operators rather than emergency response.

An unauthenticated attacker identifies a WordPress site running Simple Payment plugin version 2.5.2 or earlier, then sends a crafted HTTP request directly to the vulnerable AJAX or REST endpoint exposed by the plugin, bypassing any authorization checks to manipulate payment records - for example, marking an unpaid order as completed or altering a payment amount. No account credentials or prior access are required, making this exploitable by automated scanning tools. No public proof-of-concept code has been identified at time of analysis.