CVE-2026-12738

MediumCVSS 4.3

Published: 11/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The WP Easy Pay plugin for WordPress up to version 4.5.0 contains an authorization bypass vulnerability that allows authenticated attackers with subscriber-level access or higher to change the status of arbitrary posts and pages to 'draft', effectively unpublishing site content.

Risk Assessment

The risk involves unauthorized content unpublishing by low-privileged users, potentially disrupting site operations and eroding visitor trust.

Recommendation

It is recommended to immediately update the WP Easy Pay plugin to the latest available version that addresses this vulnerability.

Other vulnerabilities in WP Easy Pay

CVE-2026-12739Medium
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can permanently delete arbitrary posts, pages, and custom post types (bypassing the trash) or change any published post to draft status.

Original NVD description (English source)

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the status of arbitrary posts and pages to 'draft', effectively unpublishing arbitrary site content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS