WP EasyPay CVE-2026-96449

Exploitation requires that the target WordPress site have the WP EasyPay plugin (by WPExperts) installed and active at version 4.5.4 or earlier; the flaw is a missing authorization check on a plugin-provided endpoint/action, so an attacker simply needs network reachability to that endpoint. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - the limiting factor is purely the presence of the vulnerable plugin version. Impact is limited to confidentiality (C:L), so the condition yields unauthorized read/access to a restricted function rather than data modification or site takeover; the precise endpoint is not detailed in the available data.

CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating a network-reachable, low-complexity flaw requiring no authentication or user interaction, but with only limited confidentiality impact and no integrity or availability impact - consistent with a CWE-862 Missing Authorization issue that exposes data or functionality rather than enabling code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The combination of easy remote access (PR:N/AC:L) but low technical impact (C:L only) means this is a real but moderate-priority issue: broad reachability makes it opportunistically scannable, yet the bounded impact (information disclosure or unauthorized access to a limited function) keeps it below critical. The single source is Patchstack, a specialized WordPress vulnerability database; no independent vendor advisory from WPExperts is referenced, and affected versions ('n/a through 4.5.4') suggest the lower bound was not precisely established - verify the exact vulnerable range and fixed version with the vendor.

A remote, unauthenticated attacker sends a crafted HTTP request directly to a WP EasyPay plugin endpoint that fails to enforce an authorization/capability check, gaining access to a restricted function or data not intended for anonymous users. Because no authentication or user interaction is required (PR:N/UI:N) and attack complexity is low, the request can be issued at scale against any WordPress site running the plugin. No public proof-of-concept is referenced, so the specific vulnerable endpoint and payload are not confirmed from the available data.