CVE-2025-49340

MediumCVSS 4.3

Published: 31/12/2025(UTC)Updated: 28/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

A vulnerability exposing sensitive system information in the Direct Payments WP plugin (direct-payments-wp) allows an unauthorized attacker to retrieve embedded sensitive data. Affects versions up to and including 1.3.2.

Risk Assessment

An attacker can access confidential data such as API keys or configuration data, potentially leading to payment security compromise.

Recommendation

Update the Direct Payments WP plugin to the latest version and check for any data leakage.

Other vulnerabilities in Direct Payments WP

CVE-2025-49339Medium
The WordPress plugin Direct Payments WP (direct-payments-wp) up to version 1.3.2 has a Missing Authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

Original NVD description (English source)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS