WP Easy Pay EUVD-2026-43151

Exploitation requires an authenticated WordPress session at subscriber level or above - the lowest role assigned to any registered user. The WP Easy Pay plugin must be installed and active on the target site. The specific vulnerable handlers are in wpep-setup.php (lines 1698 and 1703), which process post-status changes without capability verification. On sites where open user registration is enabled (WordPress default allows this), any internet user can self-register and immediately exploit this flaw. Exploitation is limited to changing post/page status to 'draft'; it does not allow data exfiltration, account takeover, or remote code execution. Sites with closed registration (invite-only or admin-created accounts only) require the attacker to already possess a legitimate account, significantly reducing exposure.

The NVD CVSS 4.3 (Medium) score reflects the real-world impact accurately: network-accessible (AV:N), low complexity (AC:L), requires only subscriber-level authentication (PR:L), no user interaction (UI:N), limited to integrity impact (I:L). There is no confidentiality or availability impact per CVSS metrics, and scope is unchanged (S:U). The primary concern is site content disruption - an attacker can unpublish any post or page - rather than data theft or system compromise. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified numerically. KEV status is absent, and no public POC has been identified. However, the low privilege bar (subscriber) significantly elevates practical risk on WordPress installations with open registration, where anyone can create an account and immediately exploit this. Sites that restrict registration or use invite-only user creation are substantially less exposed. This is not a high-CVSS-but-low-real-risk situation - the CVSS score itself is moderate, and the real risk is proportionate: meaningful disruption potential for public-registration WordPress sites, negligible for closed-registration deployments.

An attacker registers a free subscriber account on a WordPress site with open registration and WP Easy Pay ≤4.5.0 active. They authenticate and send a crafted HTTP request to the plugin's action endpoint - targeting the unprotected handler in wpep-setup.php - specifying the ID of a published post or page and a status of 'draft'. No public exploit code exists at time of analysis, but the simplicity of the authorization bypass (missing capability check) means manual exploitation requires only knowledge of the endpoint and a valid session cookie.