Description

Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T17:17:27.320Z",
  "pubdate": "2026-09-03T17:17:27.320Z",
  "executiveSummary": "The WP EasyPay plugin for WordPress, in versions up to and including 4.5.3, contains an unauthenticated bypass vulnerability. This security flaw allows remote, unauthenticated attackers to circumvent intended security controls or access restricted functionality within the plugin.\nThe vulnerability is critical as it requires no prior authentication, enabling threat actors to interact with sensitive plugin endpoints without verifying their identity or authorization level.\nThe impact of this vulnerability includes potential unauthorized access to plugin configurations, sensitive data exposure, or the manipulation of payment-related processes, depending on the specific exposed functionality.\nGiven that the exploit does not require privileged access or administrative credentials, it poses a significant risk to the integrity and confidentiality of the WordPress site. Organizations utilizing WP EasyPay should prioritize addressing this vulnerability immediately to prevent unauthorized exploitation.",
  "technicalDetails": "The vulnerability resides in the WP EasyPay plugin's implementation of request handling and authorization checks. It stems from improper access control validation within the plugin's action hooks or REST API endpoints.\nSpecifically, the plugin fails to adequately enforce authentication checks for critical backend operations, allowing unauthenticated users to trigger functions that should be restricted to administrative users.\nThe root cause is the absence or insufficient implementation of nonce verification and capability checks (e.g., 'current_user_can()') within the affected controller functions or request handling logic. When an unauthenticated request is sent to the vulnerable endpoint, the plugin logic incorrectly assumes the request is authorized or fails to perform the necessary verification, thereby executing the requested action.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the vulnerable URL endpoint or action triggered by the plugin. The attacker constructs a malicious HTTP request (typically a GET or POST request) targeting this endpoint. Because the plugin does not validate the request's origin via nonces or check the session's authorization levels, the server processes the request as if it originated from an authorized administrator.\nBy manipulating parameters within this request, an attacker can invoke backend functionality, such as modifying plugin settings, accessing sensitive payment information, or altering transaction flows. The lack of strict access control makes this vulnerability highly dangerous as it bypasses the standard WordPress security model entirely.\nThe affected versions include all releases up to 4.5.3. The vulnerability is accessible via standard network exposure, meaning any remote attacker capable of reaching the WordPress site can perform the exploit without specific network positioning beyond reachability of the web server.\nPost-exploitation impact may vary based on the specific functions triggered, but generally includes unauthorized modifications to plugin settings, potential data exfiltration of customer information or transaction logs, and the compromise of payment-related workflows. The vulnerability bypasses security intended to prevent non-administrative users from executing administrative actions."
}