CVE-2026-90923CWE-863broken-access-control

CVE-2026-90923

Medium · published September 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-17T10:16Z
References (1)
https://wpscan.com/vulnerability/29133c48-ff5c-4295-bd18-7014d7650298/ · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 17 SEP 06:00Z
    Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
    cvelistv5