WP EasyPay EUVD-2026-37903

Exploitation requires that a WordPress site administrator holds an active, authenticated session in their browser at the moment they visit the attacker-controlled page. The WP EasyPay plugin must be installed and active on the target site. The attacker must successfully deliver the malicious URL to the administrator through phishing, malvertising, or a compromised third-party site, and the administrator must visit it without intervening logout. Exploitation is limited by this mandatory victim-interaction requirement - unauthenticated visitors or non-admin users whose sessions lack the privileges to invoke the vulnerable endpoint cannot be leveraged as victims. No special plugin configuration, non-default feature, or specific server-side state is required beyond the plugin being active.

The NVD-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) contains a likely scoring error: the UI:N (no user interaction) metric is mechanically inconsistent with a CSRF vulnerability, which by definition requires a victim to interact - visiting a malicious page or clicking a crafted link. The correct metric is UI:R, which would reduce the base score to approximately 5.4. Impact is bounded to low integrity and low availability (C:N), meaning an attacker cannot exfiltrate data but could alter payment plugin settings or disrupt functionality. No CISA KEV listing is present, no public exploit code has been identified, and EPSS data was not provided in the available intelligence. Real-world risk is moderate for sites where administrators are regularly logged into WordPress and could be lured via phishing; sites where admin sessions are short-lived or MFA is enforced face lower practical risk.

An attacker crafts a webpage containing a hidden HTML form or auto-submitting JavaScript that targets a vulnerable WP EasyPay admin endpoint. The attacker delivers the page URL to a WordPress site administrator via phishing email or social media; when the administrator loads the page while their WordPress session is active, the victim's browser automatically submits the forged request with their authenticated session cookies, causing the plugin to execute the action - such as modifying payment settings - without validating request origin. No public exploit code has been identified at time of analysis.