CVE-2026-12738: WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the status of arbitrary posts and pages to 'draft', effectively unpublishing arbitrary site content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP Easy Pay – Payment and Donation form Builder for Squareto a version that resolves this vulnerability.Fixed in 4.5.0 - Compensating control
Restrict access to the WordPress AJAX endpoint/action used by the plugin (wpep_draft_confirm) so that only users who are authorized to change post/page publication status can invoke it (e.g., enforce via application-side authorization checks or an upstream access control layer).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12738?
The severity of CVE-2026-12738 is classified as medium with a CVSS score of 4.3.
What vulnerability does CVE-2026-12738 exploit?
CVE-2026-12738 exploits an authorization bypass vulnerability in WP Easy Pay versions up to 4.5.0.
How does CVE-2026-12738 affect users?
CVE-2026-12738 allows authenticated users with Subscriber+ roles to modify post statuses without proper authorization.
How do I fix CVE-2026-12738?
To fix CVE-2026-12738, update the WP Easy Pay plugin to the latest version beyond 4.5.0.
What versions are affected by CVE-2026-12738?
CVE-2026-12738 affects all versions of the WP Easy Pay plugin up to and including 4.5.0.