Junglewise Threat Intelligence

CVE-2026-12738: saadiqbal WP Easy Pay authorization bypass in post status updates

CVE-2026-12738 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Executive brief

WP Easy Pay, a WordPress plugin used to create payment and donation forms, contains a security flaw that allows low-level users to unpublish website content. An attacker with a basic account can change the status of any post or page to 'draft' mode. This can lead to business disruption by making critical site information or donation forms invisible to the public.

Technical details

The WP Easy Pay plugin for WordPress suffers from a missing authorization check (CWE-862) in its handling of post status updates. The vulnerability exists in versions up to and including 4.5.0. An authenticated attacker with at least subscriber-level permissions can exploit this flaw via a network request to change the status of any arbitrary post or page to 'draft'. This occurs because the plugin fails to verify if the requesting user has the appropriate administrative rights to modify post statuses. A patch appears to be available in versions following 4.5.0 based on changeset references.

Affected products

  • saadiqbal WP Easy Pay – Payment and Donation form Builder for Square Up to, and including, 4.5.0

Timeline

  • 2026-07-11: disclosed: CVE published by Wordfence and NVD

References