CVE-2026-14293 Overview
CVE-2026-14293 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Autopay WordPress plugin before version 5.0.1. The plugin accepts a styling option from a public request without performing a capability check or nonce validation. It also fails to escape the stored value when rendering it on the checkout page. Unauthenticated attackers can inject JavaScript that executes in the browser of any visitor loading the checkout page, including administrators. The vulnerability carries a CVSS 3.1 base score of 8.8.
Critical Impact
Unauthenticated attackers can store persistent JavaScript that executes against administrators, enabling account takeover, session theft, and full site compromise.
Affected Products
- Autopay WordPress plugin versions prior to 5.0.1
Discovery Timeline
- 2026-08-10 - CVE-2026-14293 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-14293
Vulnerability Analysis
The Autopay plugin exposes a request handler that persists a styling option to the WordPress database. The handler does not verify user capabilities and does not validate a WordPress nonce, so any unauthenticated visitor can submit a request that overwrites the option. The stored value is later injected into the checkout page markup without output escaping. When an administrator or customer loads the checkout page, the browser parses and executes the injected script in the origin of the WordPress site.
An attacker who compromises an administrator session gains full control over the WordPress installation. This includes creating administrator accounts, installing malicious plugins, exfiltrating customer payment data, and modifying site content. The attack requires the victim to load the checkout page, which satisfies the user interaction requirement in the CVSS vector.
Root Cause
The root cause is a combination of two flaws. First, the option-saving endpoint is reachable without authentication and lacks a capability check or nonce validation. Second, the stored styling value is echoed on the checkout page without a WordPress escaping function such as esc_attr() or esc_html(). Either control alone would have blocked the attack chain.
Attack Vector
Exploitation is remote and unauthenticated over the network. An attacker sends a crafted HTTP request to the vulnerable endpoint containing a JavaScript payload embedded in the styling option field. The payload persists in the WordPress options table. When any user loads the checkout page, the payload executes in the context of the site origin. Refer to the WPScan Vulnerability Report for technical specifics.
Detection Methods for CVE-2026-14293
Indicators of Compromise
- Unexpected <script> tags, event handlers, or JavaScript URIs stored in Autopay-related rows of the wp_options table.
- HTTP POST requests to Autopay plugin endpoints from unauthenticated sources without a valid nonce parameter.
- Newly created WordPress administrator accounts or unexplained plugin installations following checkout page traffic.
- Outbound requests from administrator browsers to attacker-controlled domains after visiting the checkout page.
Detection Strategies
- Inspect the WordPress options table for Autopay styling entries containing HTML or JavaScript syntax.
- Monitor web server access logs for POST requests targeting Autopay endpoints without authenticated session cookies.
- Deploy a Web Application Firewall (WAF) rule that flags requests carrying script markup in plugin option parameters.
- Correlate checkout page loads with subsequent administrative privilege changes in the WordPress audit log.
Monitoring Recommendations
- Enable file integrity monitoring on WordPress core, plugin, and theme directories to catch attacker-installed backdoors.
- Log all administrator authentication events and privilege modifications for retrospective analysis.
- Alert on browser Content Security Policy (CSP) violation reports originating from the checkout page.
How to Mitigate CVE-2026-14293
Immediate Actions Required
- Update the Autopay WordPress plugin to version 5.0.1 or later on every affected site.
- Audit the wp_options table for malicious content in Autopay styling fields and remove any injected payloads.
- Rotate WordPress administrator passwords and invalidate active sessions in case a payload has already fired.
- Review recently created user accounts, plugins, and themes for unauthorized additions.
Patch Information
The vendor released Autopay version 5.0.1, which adds capability and nonce checks to the option-saving handler and escapes the styling value on output. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate and remove the Autopay plugin until the patched version can be installed.
- Restrict access to plugin endpoints at the web server or WAF layer to authenticated administrator IP ranges.
- Deploy a strict Content Security Policy on the checkout page to block inline script execution.
# Configuration example
# Update the Autopay plugin using WP-CLI
wp plugin update autopay --version=5.0.1
# Verify the installed version
wp plugin get autopay --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
