WordPress Plugin Vulnerabilities

Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure

Description

The Payment Forms for Paystack plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.0.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
payment-forms-for-paystack
No known fix

References

CVE
CVE-2026-66444
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/01abc69a-65c3-4acc-b190-efd8da2ec76f

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Muhan Luo
Verified
No
WPVDB ID
021d62c5-f818-443d-a686-673b752b5c67

Timeline

Publicly Published
2026-08-10 (about 1 month ago)
Added
2026-08-13 (about 1 month ago)
Last Updated
2026-08-13 (about 1 month ago)

Other

Published
Title
Published
2024-03-07
Title
Simple Restrict < 1.2.7 - Missing Authorization to Sensitive Information Exposure
Published
2026-08-05
Title
YITH WooCommerce Zoom Magnifier < 2.52.1 - Unauthenticated Information Exposure
Published
2023-10-16
Title
Social Media Share Buttons & Social Sharing Icons < 2.8.6 - Subscriber+ Sensitive Information Exposure
Published
2026-07-23
Title
Byteflows Travel & Hotel Booking < 1.0.1 - Unauthenticated Information Exposure
Published
2026-06-23
Title
24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization