CVE-2026-45215
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The WP EasyPay WordPress plugin (versions up to and including 4.3.0) contains an insertion of sensitive information into sent data vulnerability. This may allow unauthorized retrieval of embedded sensitive data.
Risk Assessment
An attacker could obtain sensitive data transmitted by the plugin, potentially leading to leakage of organizational or customer information.
Recommendation
Update the WP EasyPay plugin to a version later than 4.3.0 once a fix is available, and review the plugin configuration for transmitted data.
Other vulnerabilities in WP EasyPay
See all- CVE-2026-39734High
The WordPress plugin WP EasyPay in versions up to 4.5.4 contains an unauthenticated Path Traversal vulnerability. An unauthenticated attacker can access files outside the intended directory.
- CVE-2026-96449Medium
The WP EasyPay WordPress plugin in versions up to and including 4.5.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated user can perform actions they should not be permitted to do.
- CVE-2026-84762Medium
The WP EasyPay plugin version 4.5.3 and earlier contains an unauthenticated bypass vulnerability.
- CVE-2026-57808Medium
WP EasyPay plugin version 4.5.0 and earlier allows a subscriber to arbitrarily delete content. A subscriber can delete any data in the system.
- CVE-2026-56024Medium
The WP EasyPay WordPress plugin contains a CSRF vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. The flaw affects all versions up to and including 4.5.0.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects WP EasyPay: from n/a through <= 4.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS