CVE-2026-32587
Missing Authorization in WP EasyPay Plugin Allows Unauthorized Access
Publication date: 2026-03-16
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| saad_iqbal | wp_easypay | to 4.2.11 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32587 is a broken access control vulnerability in the WordPress WP EasyPay plugin versions up to and including 4.2.11.
This issue arises from missing authorization, authentication, or nonce token checks in certain functions, allowing unprivileged users (such as subscribers) to perform actions that require higher privileges.
It is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability allows users with only subscriber-level privileges to perform actions that should require higher privileges.
Although the CVSS severity score is 5.4, indicating a low priority threat with limited impact, it can still be exploited in mass campaigns targeting many websites indiscriminately.
The impact includes potential unauthorized changes or actions within the WP EasyPay plugin, which could affect the integrity and availability of the affected system.
Users are strongly advised to update to version 4.2.12 or later to mitigate the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization checks in the WP EasyPay plugin up to version 4.2.11, allowing subscriber-level users to perform unauthorized actions.
Detection involves verifying the plugin version installed on your WordPress site and monitoring for unauthorized actions performed by low-privilege users.
You can check the installed plugin version using the following WP-CLI command:
- wp plugin list --status=active | grep wp-easypay
To detect exploitation attempts, review your web server or WordPress logs for suspicious activity initiated by subscriber-level accounts, such as unexpected changes or actions that normally require higher privileges.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to update the WP EasyPay plugin to version 4.2.12 or later, where this vulnerability has been fixed.
If immediate updating is not possible, restrict subscriber-level user capabilities temporarily to limit potential exploitation.
Additionally, consider using automated update tools such as those offered by Patchstack to rapidly apply security patches.