CVE-2026-12738: WP Easy Pay Auth Bypass Vulnerability

CVE-2026-12738 Overview

CVE-2026-12738 is an authorization bypass vulnerability in the WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress. The flaw affects all versions up to and including 4.5.0. The plugin fails to verify that the calling user is authorized to perform an action, leading to a missing authorization weakness [CWE-862]. Authenticated attackers with subscriber-level access or above can set the status of arbitrary posts and pages to draft, effectively unpublishing arbitrary site content.

Critical Impact
Any authenticated user, including low-privileged subscribers, can unpublish arbitrary WordPress posts and pages, disrupting site availability and content integrity.

Affected Products

WP Easy Pay – Payment and Donation form Builder for Square (WordPress plugin)
All versions up to and including 4.5.0
WordPress sites using the plugin with open user registration are most exposed

Discovery Timeline

2026-07-11 - CVE-2026-12738 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12738

Vulnerability Analysis

The vulnerability resides in the WP Easy Pay plugin's WordPress action handlers defined in wpep-setup.php. The plugin registers AJAX or admin-post callbacks that modify WordPress post objects without validating whether the requesting user has the required capability, such as edit_post or edit_others_posts. As a result, an attacker only needs a valid session at subscriber level or higher to invoke the vulnerable handler. Subscriber accounts are commonly available on sites that permit self-registration, comments requiring accounts, or membership features.

The attacker supplies an arbitrary post identifier to the vulnerable endpoint, and the plugin transitions that post or page to draft status. This unpublishes the target content without touching underlying data. Repeated invocation can be used to unpublish large volumes of content, producing a targeted denial-of-service condition against public site availability.

Root Cause

The root cause is missing authorization enforcement in the plugin's post-status modification logic. The handler executes state-changing operations after only authenticating the request, without a follow-up current_user_can() capability check or nonce validation tied to a privileged context. This aligns directly with CWE-862: Missing Authorization.

Attack Vector

Exploitation is performed over the network against the WordPress site by any authenticated account. The attacker logs in with a subscriber-level account, obtains a valid session or REST nonce, and issues a request to the vulnerable WP Easy Pay endpoint referenced at lines 1698 and 1703 of wpep-setup.php. The request includes a target post or page ID. The plugin honors the request and updates the post status to draft, without confirming that the requester owns the post or holds an editorial capability.

No verified public exploit code is available at the time of publication. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-12738

Indicators of Compromise

Unexpected transitions of published posts or pages to draft status in the WordPress admin activity log
POST requests to admin-ajax.php or WP Easy Pay endpoints from user accounts that lack editorial roles
Bulk post_status change entries in the wp_posts table with recent post_modified timestamps tied to non-editor user IDs
Newly created subscriber accounts followed shortly by requests to plugin action endpoints

Detection Strategies

Correlate WordPress user role with post_status change events, and alert on subscriber or customer accounts modifying content they do not own
Inspect web server access logs for authenticated requests to WP Easy Pay handlers referenced in wpep-setup.php from low-privileged sessions
Enable WordPress audit logging plugins to capture transition_post_status events and preserve them in a centralized log store

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM for retention and correlation across user, session, and content-change events
Baseline the normal rate of post status changes per site and alert on sudden spikes to draft
Monitor for the WP Easy Pay plugin version in asset inventories and flag any host running 4.5.0 or earlier

How to Mitigate CVE-2026-12738

Immediate Actions Required

Update the WP Easy Pay – Payment and Donation form Builder for Square plugin to a version later than 4.5.0 that includes the fix referenced in the WordPress plugin changeset
Audit user accounts and remove unused subscriber-level accounts, especially on sites permitting open registration
Review recently modified posts and pages, and restore any content unexpectedly set to draft

Patch Information

The vendor has released a fix through the WordPress plugin repository. The applicable code changes are visible in the plugin trac changeset for the WP Easy Pay repository, which adds proper capability checks to the affected action handlers. Administrators should apply the update through the WordPress admin dashboard or via wp-cli using wp plugin update wp-easy-pay.

Workarounds

Deactivate the WP Easy Pay plugin until the patched version can be installed
Restrict site registration to trusted users and disable the default subscriber self-registration option under Settings > General
Deploy a web application firewall rule to block requests to the vulnerable plugin endpoints from sessions without editorial roles

bash

# Update the plugin using wp-cli once a patched release is available
wp plugin update wp-easy-pay

# Alternatively, deactivate the plugin as a temporary workaround
wp plugin deactivate wp-easy-pay

# Disable open user registration to reduce exposure
wp option update users_can_register 0