CVE-2026-81767
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Risk Assessment
An unauthenticated attacker can access administrative functions or data, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Simple Payment to a version newer than 2.5.2 and review access control configuration.
Other vulnerabilities in Simple Payment
See all- CVE-2026-96332High
Reflected XSS vulnerability in the Simple Payment plugin. Affects versions from n/a through 2.5.4.
- CVE-2026-62111Medium
The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.
- CVE-2026-81292High
Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.
Original NVD description (English source)
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS