Payment Callback Vulnerability in Autopay Plugin for WordPress by Ceddx
CVE-2026-90923
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-90923?
The Autopay WordPress plugin prior to version 5.0.1 is susceptible to an improper authentication vulnerability that fails to validate the signature on specific payment callbacks. This oversight permits unauthorized users to access sensitive payment details and potentially manipulate or delete the stored parameters of other customers' orders, posing significant risks to the confidentiality and integrity of user data.
Affected Version(s)
Autopay 0 < 5.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.