CVE-2026-81767: Simple Payment Auth Bypass Vulnerability

CVE-2026-81767 Overview

CVE-2026-81767 is an unauthenticated broken access control vulnerability in the WordPress Simple Payment plugin, affecting versions up to and including 2.5.2. The flaw is classified under CWE-862: Missing Authorization and allows network-based attackers to invoke plugin functionality without proper authorization checks. Because no authentication or user interaction is required, any remote actor with HTTP access to a vulnerable site can trigger the affected endpoints. The vulnerability primarily impacts data integrity on affected WordPress installations.

Critical Impact
Remote unauthenticated attackers can bypass access controls in the Simple Payment plugin to modify payment-related data or invoke restricted actions on affected WordPress sites.

Affected Products

WordPress Simple Payment plugin versions <= 2.5.2
WordPress sites with the Simple Payment plugin installed and activated
Any hosting environment exposing the affected plugin endpoints to untrusted networks

Discovery Timeline

2026-08-28 - CVE-2026-81767 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-81767

Vulnerability Analysis

The Simple Payment plugin exposes one or more actions that fail to enforce authorization checks before executing privileged operations. Attackers reach the vulnerable endpoints over the network without authenticating. Because the plugin does not verify the caller's capability or role, requests that should be restricted to authorized users are processed. According to the Patchstack Vulnerability Report, the flaw permits actions that alter data managed by the plugin. The CVSS vector indicates that only integrity is impacted, meaning confidentiality of stored records and availability of the site are not directly affected. However, tampering with payment configurations or transaction records can still produce downstream business and financial consequences. The EPSS score for this vulnerability is 0.202%.

Root Cause

The root cause is a missing authorization check ([CWE-862]) on plugin request handlers. The affected code paths execute state-changing operations without validating that the requester holds the required WordPress capability or a valid nonce. Requests reach protected functions through public entry points such as admin-ajax.php or REST routes without a capability gate.

Attack Vector

An attacker sends crafted HTTP requests directly to the vulnerable plugin endpoints on a target WordPress site. No credentials, session, or user interaction are required. The attacker only needs network reachability to the target and knowledge of the endpoint action names, which are typically discoverable from the plugin source. Refer to the Patchstack Vulnerability Report for further technical details.

No verified public proof-of-concept code is available at this time. The vulnerability mechanism reduces to invoking a plugin action handler over HTTP without a valid capability check, and observing that the server processes the request and mutates state.

Detection Methods for CVE-2026-81767

Indicators of Compromise

Unexpected changes to Simple Payment plugin settings, payment configurations, or stored transaction records
HTTP POST requests to wp-admin/admin-ajax.php or plugin REST routes from unauthenticated sessions referencing Simple Payment actions
Access log entries showing repeated requests to Simple Payment endpoints from a small set of source IPs prior to configuration changes

Detection Strategies

Inventory WordPress installations and identify sites running Simple Payment plugin versions 2.5.2 or earlier
Enable WordPress audit logging to record administrative actions and plugin option changes, then alert on modifications originating from anonymous or unauthenticated contexts
Correlate web server access logs with database change events to detect state changes that lack a preceding authenticated admin session

Monitoring Recommendations

Monitor web application firewall (WAF) logs for requests targeting Simple Payment action names without authentication cookies
Track outbound notifications, invoices, or payment confirmations for anomalies that suggest tampered plugin state
Alert on newly created or modified plugin database rows outside of scheduled administrative windows

How to Mitigate CVE-2026-81767

Immediate Actions Required

Identify all WordPress sites running Simple Payment plugin <= 2.5.2 and prioritize them for remediation
Update the Simple Payment plugin to the version that addresses CVE-2026-81767 as published by the vendor
If a patched version is not yet available, deactivate and remove the plugin until a fix is released
Review plugin data, options, and recent transactions for signs of unauthorized modification

Patch Information

Refer to the Patchstack Vulnerability Report for the latest patch status and fixed version guidance. Apply the vendor-supplied update to a version later than 2.5.2 as soon as it is available.

Workarounds

Restrict access to wp-admin/admin-ajax.php and plugin REST routes via WAF rules that block unauthenticated requests referencing Simple Payment actions
Enforce IP allowlisting on WordPress administrative endpoints where feasible
Disable the Simple Payment plugin on non-production sites until patched to reduce exposure

bash

# Example WAF rule concept: block unauthenticated POSTs to Simple Payment actions
# Adapt to your WAF syntax (ModSecurity, Cloudflare, AWS WAF, etc.)
# Match: URI contains admin-ajax.php AND body contains action=simple_payment_*
# Condition: Cookie header lacks wordpress_logged_in_*
# Action: block and log