Executive Summary

CVE-2026-32587 is a broken access control vulnerability in the WordPress WP EasyPay plugin versions up to and including 4.2.11.

This issue arises from missing authorization, authentication, or nonce token checks in certain functions, allowing unprivileged users (such as subscribers) to perform actions that require higher privileges.

It is classified under the OWASP Top 10 category A1: Broken Access Control.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows users with only subscriber-level privileges to perform actions that should require higher privileges.

Although the CVSS severity score is 5.4, indicating a low priority threat with limited impact, it can still be exploited in mass campaigns targeting many websites indiscriminately.

The impact includes potential unauthorized changes or actions within the WP EasyPay plugin, which could affect the integrity and availability of the affected system.

Users are strongly advised to update to version 4.2.12 or later to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from missing authorization checks in the WP EasyPay plugin up to version 4.2.11, allowing subscriber-level users to perform unauthorized actions.

Detection involves verifying the plugin version installed on your WordPress site and monitoring for unauthorized actions performed by low-privilege users.

You can check the installed plugin version using the following WP-CLI command:

• wp plugin list --status=active | grep wp-easypay

To detect exploitation attempts, review your web server or WordPress logs for suspicious activity initiated by subscriber-level accounts, such as unexpected changes or actions that normally require higher privileges.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to update the WP EasyPay plugin to version 4.2.12 or later, where this vulnerability has been fixed.

If immediate updating is not possible, restrict subscriber-level user capabilities temporarily to limit potential exploitation.

Additionally, consider using automated update tools such as those offered by Patchstack to rapidly apply security patches.

Useful 0 Not Useful 0