WP EasyPay EUVD-2026-48183

Exploitation requires the attacker to hold at least a WordPress subscriber-level account on the target site (confirmed by CVSS PR:L). This is only achievable externally if the WordPress site has open user registration enabled (Settings > General > Membership). The WP EasyPay plugin must be installed and active. No additional non-default configuration is required beyond these conditions. Exploitation is blocked on sites where user registration is disabled and no valid subscriber credentials are available to the attacker. Content deletion is irreversible without a database backup, amplifying impact even without credential escalation.

The CVSS 3.1 score of 6.5 Medium with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately reflects the risk profile. Network reachability and low complexity confirm remote exploitability with no user interaction, but PR:L is a meaningful constraint - exploitation requires at least a subscriber account, meaning the attack surface is limited to sites with open user registration or a compromised subscriber credential. The High integrity impact accurately captures the consequence: permanent, irreversible content deletion. No EPSS score was provided in source data and this CVE is not listed in CISA KEV, so there is no confirmed active exploitation signal. The 'Authentication Bypass' tag is potentially misleading - this is a missing authorization flaw, not an authentication bypass - and should not be interpreted as meaning the vulnerability is unauthenticated. Real-world risk is elevated for membership sites, forums, or e-commerce platforms that allow public self-registration, and lower for closed WordPress installations with no external subscriber accounts.

An attacker self-registers a subscriber account on a WordPress site with open user registration and WP EasyPay 4.5.0 active. Using the subscriber session token, the attacker sends crafted HTTP requests targeting the plugin's content deletion endpoint with arbitrary post IDs as parameters. Because no authorization check verifies the subscriber's privilege to delete that content, the requests succeed and the targeted posts or pages are permanently removed from the database.