Wp Easy Pay Payment And Donation Form Builder For Square
Monthly
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Authorization bypass in the WP Easy Pay WordPress plugin (versions ≤4.5.0) allows any authenticated WordPress user at subscriber level or above to set arbitrary posts and pages to 'draft', silently unpublishing site content without editorial authorization. The flaw stems from missing capability checks in the plugin's action handlers (wpep-setup.php), confirmed by Wordfence with direct source code references. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the low barrier to exploitation - any registered user qualifies - makes this a meaningful risk on sites with open user registration.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Authorization bypass in the WP Easy Pay WordPress plugin (versions ≤4.5.0) allows any authenticated WordPress user at subscriber level or above to set arbitrary posts and pages to 'draft', silently unpublishing site content without editorial authorization. The flaw stems from missing capability checks in the plugin's action handlers (wpep-setup.php), confirmed by Wordfence with direct source code references. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the low barrier to exploitation - any registered user qualifies - makes this a meaningful risk on sites with open user registration.