UNKNOWN NVD

CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

References

https://wpscan.com/vulnerability/29133c48-ff5c-4295-bd18-7014d7650298/

Published: 2026-09-17 · Source: NVD · Feed updated: 2026-09-17

This unknown severity vulnerability was published on 2026-09-17 via NVD.

vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.