WordPress Plugin Vulnerabilities

Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

Description

The plugin does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

Proof of Concept

Affects Plugins

Plugin icon
platnosci-online-blue-media
Fixed in 5.0.1

References

CVE
CVE-2026-90923

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
29133c48-ff5c-4295-bd18-7014d7650298

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2026-06-19
Title
LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration
Published
2024-07-23
Title
WooCommerce - PDF Vouchers < 4.9.4 - Authentication Bypass to Voucher Vendor
Published
2026-08-27
Title
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
Published
2024-03-28
Title
Booking Package < 1.6.29 - Unauthenticated Price Manipulation
Published
2025-04-16
Title
Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products < 2.7.8 - Unauthenticated Sensitive Information Exposure