CVE-2026-96449: WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability
Published Oct 15, 2026
·Updated
Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.
Affected Software
1 affected component
Wpexperts WP EasyPay<=4.5.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wp-easy-payto a version that resolves this vulnerability.Fixed in 4.5.5
Event History
Oct 15, 2026
CVE Published
via MITRE·06:06 PM
Data Sourced
via MITRE·06:06 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
WPExperts WP EasyPay versions through 4.5.4 are affected. The available data does not identify a fixed version.
2
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the expected impact?
The reported impact is limited to confidentiality. The CVSS vector indicates low confidentiality impact and no integrity or availability impact.