PT-2026-57413 · WordPress · Wp Easypay

Prism · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-12738

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Easy Pay – Payment and Donation form Builder for Square versions prior to 4.5.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this to change the status of arbitrary posts and pages to 'draft', which results in the unpublishing of site content.

Recommendations Update WP Easy Pay – Payment and Donation form Builder for Square to version 4.5.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12738

Affected Products

Wp Easypay

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-12738 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-easy-pay/tags/4.5.0/wpep-setup.php#L31 · Note
• https://twitter.com/CVEnew/status/2075869784202232133 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3593500%40wp-easy-pay&new=3593500%40wp-easy-pay · Note
• https://plugins.trac.wordpress.org/browser/wp-easy-pay/tags/4.5.0/wpep-setup.php#L1698 · Note
• https://twitter.com/infoflowcloud/status/2075871691004154034 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2121d9fa-bab4-489d-89bc-07a8660bc3d1?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-easy-pay/tags/4.5.0/wpep-setup.php#L1703 · Note