WP EasyPay vulnerabilities

WP EasyPay plugin version 4.5.0 and earlier allows a subscriber to arbitrarily delete content. A subscriber can delete any data in the system.

The WP EasyPay WordPress plugin in versions up to and including 4.5.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated user can perform actions they should not be permitted to do.

The WP EasyPay plugin version 4.5.3 and earlier contains an unauthenticated bypass vulnerability.

The WP EasyPay WordPress plugin contains a CSRF vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in administrator. The flaw affects all versions up to and including 4.5.0.