CVE-2026-12739: WP Easy Pay Authorization Bypass Vulnerability

CVE-2026-12739 Overview

CVE-2026-12739 is an authorization bypass vulnerability in the WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress. The flaw affects all versions up to and including 4.5.0. The plugin fails to properly verify that a user is authorized to perform sensitive actions on posts and pages. Authenticated attackers with subscriber-level access or higher can permanently delete arbitrary posts, pages, and custom post types by bypassing the trash through force deletion. The same weakness allows attackers to change any published post to draft status, disrupting site content availability.

Critical Impact

Low-privileged authenticated users can permanently delete arbitrary WordPress content or unpublish published posts across a vulnerable site.

Affected Products

• WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress (all versions ≤ 4.5.0)
• WordPress sites with subscriber-level or higher user registration enabled
• Any site running the vulnerable wpep-setup.php handler prior to changeset 3593500

Discovery Timeline

• 2026-09-18 - CVE-2026-12739 published to NVD
• 2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-12739

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw classified under [CWE-862]. The plugin exposes AJAX-driven actions that operate on arbitrary WordPress post objects without confirming the requester has the required capabilities. Authenticated users at the WordPress subscriber role — the lowest-privileged authenticated tier — can invoke these actions.

Because the actions accept an attacker-supplied post identifier, an authenticated user can target any post, page, or custom post type on the site. Two impact paths are documented: forced deletion, which bypasses the WordPress trash and permanently removes content, and a status change that moves published posts back to draft. Both actions damage content integrity and availability. See the Wordfence Vulnerability Report for the technical writeup.

Root Cause

The root cause is the absence of current_user_can() capability checks in the plugin's post-management handlers registered in wpep-setup.php. Nonce validation alone — if present — is insufficient because any authenticated user can obtain a valid nonce. The plugin does not gate delete and status-change operations behind delete_post or edit_post capability checks tied to the specific target object. Vulnerable code paths are referenced in the plugin source at lines 30, 31, 37, 1658, 1663, 1695, and 1703 of wpep-setup.php.

Attack Vector

Exploitation requires a valid authenticated session at subscriber level or above and network access to the WordPress admin-ajax.php endpoint. An attacker registers or compromises a low-privileged account, then sends a crafted AJAX request containing the plugin's action name and the post_id of the target content. The server-side handler processes the request without validating authorization and executes wp_delete_post( $post_id, true ) for force deletion or updates post_status to draft. No user interaction from a privileged admin is required. See the plugin changeset for the corrective patch.

Detection Methods for CVE-2026-12739

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php referencing WP Easy Pay action names originating from subscriber-role user sessions.
• WordPress audit-log entries showing post status transitions from publish to draft performed by non-editor accounts.
• Missing posts, pages, or custom post types with no corresponding entry in the wp_posts trash state.
• Spikes in AJAX requests carrying attacker-controlled post_id parameters.

Detection Strategies

• Enable a WordPress activity/audit log plugin to record post deletions and status changes with associated user IDs and IP addresses.
• Alert on any content deletion or status change performed by accounts with the subscriber, customer, or contributor role.
• Inspect web server access logs for repeated admin-ajax.php calls from a single authenticated session iterating through post_id values.

Monitoring Recommendations

• Ingest WordPress and web server logs into a centralized SIEM and correlate authentication events with content-modification actions.
• Monitor the plugin version deployed across managed WordPress fleets and flag installations at version 4.5.0 or lower.
• Track new low-privileged user registrations followed shortly by AJAX activity targeting plugin action names.

How to Mitigate CVE-2026-12739

Immediate Actions Required

• Update the WP Easy Pay – Payment and Donation form Builder for Square plugin to a version later than 4.5.0 that contains the fix from changeset 3593500.
• Audit existing WordPress accounts and remove unused subscriber-level users, particularly self-registered accounts.
• Review recent post deletions and status changes and restore affected content from backup where necessary.
• If open registration is not required, disable the WordPress "Anyone can register" setting until patched.

Patch Information

The vendor addressed the vulnerability in the plugin repository under changeset 3593500. The fix adds capability checks to the affected handlers in wpep-setup.php. Site operators should upgrade through the WordPress plugin updater to the latest available release.

Workarounds

• Deactivate and remove the WP Easy Pay plugin until an updated version can be installed.
• Restrict access to /wp-admin/admin-ajax.php for low-privileged roles using a web application firewall (WAF) rule that blocks the plugin's vulnerable action names.
• Enforce least-privilege by demoting any unnecessary accounts to no role or removing them entirely.
• Require multi-factor authentication for all authenticated WordPress accounts to raise the cost of credential-based abuse.

# Example WAF rule (ModSecurity) blocking vulnerable plugin AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1029739,phase:2,deny,status:403,\
     msg:'Block WP Easy Pay vulnerable actions (CVE-2026-12739)'"
    SecRule ARGS:action "@rx ^(wpep_delete_post|wpep_update_post_status)$" "t:none"