medium6.5
CVE-2026-90923
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete…
Impact
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
Affected products
| Product | Affected versions |
|---|---|
| Autopay WordPress Plugin | before 5.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.