CVE-2026-110042

MediumCVSS 4.9

Published: 31/10/2026(UTC)Updated: 01/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration. Users with the Contributor role and above can view secret payment-gateway API credentials, both live and test secret keys, which grant full access to the site owner's payment account.

Risk Assessment

Exposure of payment gateway API keys enables unauthorized access to the payment account, potentially leading to unauthorized transactions or theft of funds. The risk applies to both production and test environments.

Recommendation

Update the Payment Forms for Paystack plugin to version 4.0.6 or later. Immediately revoke and regenerate Paystack API keys if they may have been exposed.

Other vulnerabilities in Payment Forms for Paystack

CVE-2026-66444Medium
Sensitive Data Exposure vulnerability in Payment Forms for Paystack versions up to 4.0.5, exploitable by a user with Subscriber role.

Original NVD description (English source)

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS