CVE-2026-90923 — Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored paymen…
Published: 2026-09-17 · CVSS: 6.5 · CVSS 3.1
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7