Subscriber Arbitrary Content Deletion in WP EasyPay

Executive Summary

CVE-2026-57808 is a vulnerability in the WordPress WP EasyPay Plugin versions 4.5.0 and earlier. It allows attackers with subscriber-level access to delete arbitrary content such as posts, pages, or images from a website.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized content deletions in WordPress logs or database. Look for suspicious activity from subscriber-level accounts. Use WordPress security plugins to monitor file changes and user actions.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to remove important website content, disrupting operations or causing data loss. The vulnerability has a CVSS score of 6.5, indicating moderate danger and potential for widespread exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP EasyPay plugin to version 4.5.1 or later immediately. Apply Patchstack's mitigation rule to block attacks until the update is complete. Review and restrict subscriber-level access permissions.

Useful 0 Not Useful 0