CVE-2026-12738— WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| saadiqbal | WP Easy Pay – Payment and Donation form Builder for Square | ≤ 4.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12738
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
Source: NVD (National Vulnerability Database)
Vulnerability Description
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the status of arbitrary posts and pages to 'draft', effectively unpublishing arbitrary site content.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress WP Easy Pay 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress WP Easy Pay是WordPress基金会的一款网站支付集成组件。 WordPress WP Easy Pay 4.5.0及之前版本存在授权问题漏洞，该漏洞源于未正确验证用户是否被授权执行操作，可能导致经过身份验证的攻击者将任意文章和页面的状态设置为'draft'，从而取消发布任意站点内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| saadiqbal | WP Easy Pay – Payment and Donation form Builder for Square | 0 ~ 4.5.0 | - |
II. Public POCs for CVE-2026-12738
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12738
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: saadiqbal
- CVE-2026-12097
User Management <= 1.2 - Missing Authorization to Unauthenti - CVE-2026-8607
myCred – Points Management System For Gamification, Ranks, B - CVE-2026-7430
Post Snippets <= 4.0.19 - Authenticated (Administrator+) Sto - CVE-2026-3090
Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-2559
Post SMTP <= 3.8.0 - Missing Authorization to Authenticated
Same weakness: CWE-862
- CVE-2026-13765
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticat - CVE-2026-15349
ERP: Complete HR, Accounting & CRM Suite Built for WooCommer - CVE-2026-8616
Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization t - CVE-2026-62235
Grav Flex-Objects < 1.4.3 Authorization Bypass via API - CVE-2026-62232
Grav < 2.0.4 2FA Bypass via Secret Regeneration
V. Comments for CVE-2026-12738
No comments yet