CVE-2026-110042: Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page

Q: Which users can access the exposed credentials?

Any authenticated WordPress user with the Contributor role or a higher role can view the plugin's stored configuration page. Unauthenticated visitors are not described as affected.

Q: What credentials are exposed, and what could they enable?

The affected page exposes both live and test Paystack secret API keys. The live secret key grants full access to the site owner's payment account.

Q: Which installations are affected?

Payment Forms for Paystack versions before 4.0.6 are affected. The issue concerns access control for the page displaying stored plugin configuration.

Published Oct 31, 2026

Updated

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can access the exposed credentials?

Any authenticated WordPress user with the Contributor role or a higher role can view the plugin's stored configuration page. Unauthenticated visitors are not described as affected.

What credentials are exposed, and what could they enable?

The affected page exposes both live and test Paystack secret API keys. The live secret key grants full access to the site owner's payment account.

Which installations are affected?

Payment Forms for Paystack versions before 4.0.6 are affected. The issue concerns access control for the page displaying stored plugin configuration.

CVE-2026-110042: Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page

Event History

Frequently Asked Questions

Which users can access the exposed credentials?

What credentials are exposed, and what could they enable?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can access the exposed credentials?

What credentials are exposed, and what could they enable?

Which installations are affected?