Paystack Payment Forms EUVD-2026-114580

The attacker must hold an authenticated account with the WordPress Contributor role or higher on the target site, and the Payment Forms for Paystack plugin (before 4.0.6) must be installed with Paystack secret keys configured, so that the plugin's configuration-display page actually contains live and test secret keys to leak. There is no victim interaction requirement. The practical limiting factors are therefore the need for a valid low-privileged account (relevant on sites with open registration or multiple content contributors) and the presence of configured Paystack credentials; the trigger beyond visiting the stored-configuration page is not further detailed in the available sources.

This is a genuine but moderate-priority issue rather than an urgent emergency, and the signals are internally consistent on that point. The input CVSS (4.9, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) captures a network-reachable, low-complexity confidentiality-only disclosure requiring privileges. EPSS is very low (0.15%, 4th percentile), SSVC reports Exploitation: none and Automatable: no with only partial Technical Impact, and the CVE is not on CISA KEV, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_month', which aligns with a patch-on-normal-cadence posture rather than act_now/emergency. One notable conflict: the supplied CVSS encodes PR:H, but the description states that any user with the Contributor role 'and above' can trigger the disclosure, and Contributor is a low-privilege authenticated WordPress role - this points to PR:L, which would raise the true base severity (to ~6.5) and lower the practical barrier to exploitation; verify the privilege level against the WPScan advisory. The impact if exploited is serious despite the modest score, because the disclosed data are live and test secret payment-gateway API keys granting full access to the site owner's Paystack account, so a low-privileged insider or a compromised/self-registered contributor account becomes a direct path to payment-account takeover.

A site that allows user registration or has delegated content-contribution accounts grants an attacker (or a malicious insider) a Contributor-level login; the attacker then opens the plugin page that renders the stored configuration and reads the live and test Paystack secret keys, which they use to access and control the site owner's payment account. No public exploit is identified at the time of analysis, and exploitation is low-complexity (AC:L) but requires an authenticated account and no victim interaction (UI:N).