CVE-2026-90923
Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
| Vendor | unknown |
| Product | autopay |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown autopay
Be the first to know when new medium vulnerabilities affecting unknown autopay are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Autopay
0 < 5.0.1
References
Credits
Artus KG WPScan