WP EasyPay EUVD-2026-70582

No authentication is required (CVSS PR:N) and no user interaction is necessary (CVSS UI:N). The target WordPress site must have the WP EasyPay plugin installed and active in version 4.5.3 or earlier. Exploitation is bounded to the specific parameter(s) the plugin assumes are server-controlled; impact is restricted to low-level integrity modification (CVSS I:L) with no confidentiality or availability impact. The exact parameter name and affected endpoint are not disclosed in publicly available advisory data, providing minor obscurity that should not be relied upon as a compensating control.

The CVSS 3.1 base score of 5.3 Medium is consistent with the constrained impact profile: the attack vector is network, complexity is low, no privileges or user interaction are required, but the scope is unchanged and only integrity is affected at a low level. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, making widespread automated exploitation unlikely at present. EPSS data was not provided, so exploitation probability cannot be quantified. Even a mid-sized municipal IT team in inowroclaw running a WordPress payment site with this plugin should treat the upgrade as routine maintenance rather than an emergency response, given the limited blast radius. The primary real-world concern is unauthorized parameter manipulation bypassing lightweight access gates - not full site compromise.

An unauthenticated attacker sends a crafted HTTP POST or GET request to a WordPress site running WP EasyPay, supplying a modified value for a parameter the plugin treats as immutable - such as a payment status flag, authorization token, or access-control indicator. The plugin accepts the tampered value without server-side validation, allowing the attacker to bypass the intended access control and alter application state. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the technique would be straightforward once the specific parameter and endpoint are identified.