Security
Loading…

CVE-2026-90923

MEDIUMCVSS 6.5
View on NVD← Back to search
Description

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

Timeline
Published:September 17th, 2026 6:16 AM
Last modified:September 18th, 2026 7:08 PM
CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)
CWE-863
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute