CVE-2026-90923: Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

Q: Which deployments are exposed?

WordPress sites using the Autopay plugin in versions before 5.0.1 are affected. The issue is in a payment callback that does not enforce its signature.

Q: Does exploitation require authentication or a valid payment callback signature?

No. The vulnerable callback can be used by unauthenticated users because the signature is not enforced.

Q: What can an attacker do through the vulnerable callback?

An attacker can disclose and delete stored payment parameters associated with other customers' orders.

Published Sep 17, 2026

Updated

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

Affected Software

1 affected component

wordpress/autopay<5.0.1

Event History

Sep 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

WordPress sites using the Autopay plugin in versions before 5.0.1 are affected. The issue is in a payment callback that does not enforce its signature.

Does exploitation require authentication or a valid payment callback signature?

No. The vulnerable callback can be used by unauthenticated users because the signature is not enforced.

What can an attacker do through the vulnerable callback?

An attacker can disclose and delete stored payment parameters associated with other customers' orders.