CVE-2026-56024
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The WP EasyPay WordPress plugin contains a CSRF vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. The flaw affects all versions up to and including 4.5.0.
Risk Assessment
An attacker can exploit CSRF to modify plugin settings, inject fake transactions, or steal data, compromising system integrity and confidentiality.
Recommendation
Immediately update the WP EasyPay plugin to the latest available version that fixes this vulnerability. Also implement CSRF token mechanisms in all forms.
Other vulnerabilities in WP EasyPay
See all- CVE-2026-57808Medium
WP EasyPay plugin version 4.5.0 and earlier allows a subscriber to arbitrarily delete content. A subscriber can delete any data in the system.
- CVE-2026-96449Medium
The WP EasyPay WordPress plugin in versions up to and including 4.5.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated user can perform actions they should not be permitted to do.
- CVE-2026-84762Medium
The WP EasyPay plugin version 4.5.3 and earlier contains an unauthenticated bypass vulnerability.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS