EUVD-2026-70582
GHSA-hf7c-m25v-h5gp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no credentials or user interaction required; integrity-only low impact consistent with parameter-tampering bypass, no confidentiality or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.
AnalysisAI
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access controls by manipulating web parameters the plugin treats as server-authoritative and immutable. The flaw (CWE-472) results in a low-level integrity impact - attackers can alter application state without credentials - but carries no confidentiality or availability consequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required (CVSS PR:N) and no user interaction is necessary (CVSS UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 Medium is consistent with the constrained impact profile: the attack vector is network, complexity is low, no privileges or user interaction are required, but the scope is unchanged and only integrity is affected at a low level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade WP EasyPay to a version beyond 4.5.3; however, an exact patched release number is not specified in the available advisory data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-easy-pay/vulnerability/wordpress-wp-easypay-plugin-4-5-3-bypass-vulnerability-vulnerability for the confirmed fixed version before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Easypay
View allThe WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, lea
Cross-site request forgery in the WP EasyPay WordPress plugin (versions through 4.4.0) enables remote attackers to perfo
WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrar
The WP EasyPay - Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a mi
WP EasyPay versions up to 4.2.11 contain an authorization bypass that allows authenticated users to modify plugin settin
WP EasyPay plugin through version 4.3.0 exposes sensitive information in sent data, allowing unauthenticated remote atta
The WP EasyPay - Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to
Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay - Square for WordPress plugin <= 4.1 versions.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today