Skip to content
Sign in
6.5 Medium

CVE-2026-90923 The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing…

Description

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

Affected products and versions

Product Affected versions Fixed in
Autopay 5.0 earliest → < 5.0.1 5.0.1

Other CVEs of Autopay

The 2 CVEs of Autopay →
CVE-2026-14293 The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling… 8.8 High
Track this CVE