CVE-2026-12739
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can permanently delete arbitrary posts, pages, and custom post types (bypassing the trash) or change any published post to draft status.
Risk Assessment
An attacker could delete important content or disrupt site operations, leading to data loss and negative impact on service availability.
Recommendation
Update the WP Easy Pay plugin to the latest version with the fix. Limit the number of low-privilege accounts and regularly audit user permissions.
Other vulnerabilities in WP Easy Pay
Original NVD description (English source)
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary posts, pages, and custom post types (bypassing the trash via force deletion) or change any published post to draft status.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS