WP EasyPay EUVD-2026-29457

The vulnerability requires no authentication, no user interaction, and no special configuration - it is exploitable against default plugin installations accessible over the network. The sensitive data exposure occurs during normal plugin operation when the plugin handles payment requests or data retrieval. No specific payload, timing, or deployment mode limitation is indicated. The only limiting factor is that the attacker must be able to reach the plugin's endpoints over the network (not blocked by firewall or access controls).

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity and no authentication required, suggesting broad attack surface. The 5.3 score reflects confidentiality impact only (no integrity or availability loss), typical for passive information disclosure. However, the real-world risk depends on WHICH sensitive data is exposed: if payment credentials, API keys, or customer personally identifiable information (PII) are compromised, the impact far exceeds the CVSS rating and creates secondary risks (fraud, identity theft, regulatory violation). The lack of CISA KEV confirmation suggests either limited active exploitation or recent disclosure. The CVSS vector's AV:N/AC:L/PR:N/UI:N characteristics indicate this is not a complex attack requiring special conditions. Risk severity is elevated given that WP EasyPay handles financial transactions; any exposure of payment-related data poses significant business and legal liability. The absence of published POC data or EPSS score means defenders must treat the network-accessible nature and low-complexity barrier as high-priority indicators regardless of exploitation prevalence.

An attacker sends unauthenticated HTTP requests to the WP EasyPay plugin's API endpoints or form submission handlers, receiving responses that contain embedded sensitive information such as API keys, customer payment details, or transaction identifiers. The attacker captures these responses (via network sniffing, proxy interception, or server-side request forgery) and extracts the sensitive data for further exploitation, such as unauthorized API calls or customer data theft.