CVE-2026-12739: WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary posts, pages, and custom post types (bypassing the trash via force deletion) or change any published post to draft status.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP Easy Pay – Payment and Donation form Builder for Squareto a version that resolves this vulnerability.Fixed in 4.5.0 - Compensating control
Restrict non-administrative accounts from having functionality that allows permanent deletion or status changes until the plugin is upgraded (e.g., limit subscriber-level access to the minimum required).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the affected WordPress site with at least Subscriber-level access. Unauthenticated visitors are not described as able to exploit it.
What content can be affected?
A qualifying low-privileged user can permanently delete arbitrary posts, pages, and custom post types, bypassing the WordPress trash. They can also change published posts to draft status.
Are affected sites exposed by default?
Exploitation requires an authenticated account, so exposure depends on whether untrusted users can obtain or use Subscriber-level or higher accounts. The provided data does not identify any additional configuration prerequisite.
How can I determine whether my site is affected?
Sites using WP Easy Pay – Payment and Donation form Builder for Square version 4.5.0 or earlier are affected according to the provided information. Review WordPress content status changes and permanent deletions performed by low-privileged accounts for possible indicators of exploitation.