CVE-2026-90923: Autopay WordPress Plugin Info Disclosure

CVE-2026-90923 Overview

CVE-2026-90923 affects the Autopay WordPress plugin in versions prior to 5.0.1. The plugin fails to enforce signature verification on one of its payment callback endpoints. Unauthenticated attackers can abuse this weakness to disclose and delete stored payment parameters belonging to other customers' orders. The flaw is categorized under [CWE-863] Incorrect Authorization and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can read and delete stored payment parameters for arbitrary customer orders processed by the Autopay plugin.

Affected Products

Autopay WordPress plugin versions before 5.0.1
WordPress sites processing payments through the Autopay callback endpoint
E-commerce deployments exposing the unauthenticated Autopay payment callback

Discovery Timeline

2026-09-17 - CVE-2026-90923 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90923

Vulnerability Analysis

The Autopay plugin exposes a payment callback endpoint used to process asynchronous notifications from the payment provider. One of these callback handlers accepts request parameters without validating the cryptographic signature that authenticates the sender. Any HTTP client can invoke the endpoint and reference arbitrary order identifiers.

Because the handler proceeds to read and modify order records tied to the supplied identifiers, an attacker can enumerate orders and trigger destructive operations. The plugin returns stored payment parameters in the response and removes them from the database. This breaks confidentiality and integrity guarantees for legitimate customer transactions.

Root Cause

The root cause is a missing authorization check [CWE-863]. The callback handler trusts request parameters implicitly rather than verifying the HMAC or signature field that the payment provider attaches. Signature validation is a documented control for Autopay callbacks, but the affected code path omits it. Prior to version 5.0.1, no server-side enforcement prevents unsigned or forged callbacks from reaching sensitive order logic.

Attack Vector

An attacker sends a crafted HTTP request directly to the vulnerable callback URL on the WordPress site. The request includes an order identifier that belongs to another customer. Because signature verification is absent, the handler processes the request and returns the stored payment parameters. The same request path also deletes those parameters from the database. No authentication, credentials, or user interaction are required. See the WPScan Vulnerability Report for the disclosure details.

Detection Methods for CVE-2026-90923

Indicators of Compromise

Unauthenticated HTTP requests to the Autopay callback endpoint originating from external or unexpected IP addresses
Callback requests missing the expected signature parameter or containing invalid signature values
Enumeration patterns where a single client iterates through sequential order identifiers
Customer reports of missing payment parameters or order records that no longer resolve payment metadata

Detection Strategies

Inspect WordPress access logs for requests to Autopay callback URLs that lack a valid signature field
Correlate callback requests with the payment provider's outbound notification logs to identify unmatched traffic
Alert on high-frequency callback invocations from a single source address within a short window

Monitoring Recommendations

Enable verbose logging on the Autopay callback endpoint and forward logs to a centralized SIEM
Monitor WordPress database write and delete events on tables that store Autopay payment parameters
Track anomalies in order status transitions that indicate parameter tampering or removal

How to Mitigate CVE-2026-90923

Immediate Actions Required

Upgrade the Autopay WordPress plugin to version 5.0.1 or later on all affected sites
Audit recent access logs for the callback endpoint and identify any suspicious unauthenticated requests
Reconcile order and payment records with the payment provider to identify tampered or deleted entries
Notify affected customers if evidence of payment parameter disclosure or deletion is confirmed

Patch Information

The vendor addressed the issue in Autopay plugin version 5.0.1 by enforcing signature verification on the previously unprotected payment callback. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI. Additional context is available in the WPScan Vulnerability Report.

Workarounds

Restrict access to the Autopay callback endpoint at the web server or WAF layer to the payment provider's published IP ranges
Deploy a web application firewall rule that blocks callback requests lacking the expected signature parameter
Temporarily disable the Autopay plugin on non-production or low-volume sites until patching is complete

bash

# Configuration example: restrict Autopay callback to provider IPs (nginx)
location ~* /wp-content/plugins/autopay/callback {
    allow 203.0.113.0/24;   # Replace with Autopay provider ranges
    deny all;
}