CVE-2025-49339

MediumCVSS 4.3

Published: 31/12/2025(UTC)Updated: 28/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

The WordPress plugin Direct Payments WP (direct-payments-wp) up to version 1.3.2 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

Risk Assessment

An unauthorized person may perform operations requiring higher privileges, potentially leading to unauthorized changes in payments or data.

Recommendation

Update the Direct Payments WP plugin to the latest version. Review permission configuration and restrict access to administrative functions.

Other vulnerabilities in Direct Payments WP

CVE-2025-49340Medium
A vulnerability exposing sensitive system information in the Direct Payments WP plugin (direct-payments-wp) allows an unauthorized attacker to retrieve embedded sensitive data. Affects versions up to and including 1.3.2.

Original NVD description (English source)

Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS