Vulnerabilities / Payment Forms for Paystack / WPSEC-2026-1845
Payment Forms for Paystack <= 4.0.5 - Authenticated (Contributor+) Sensitive Information Exposure via Settings Page
Medium 6.5
CWE-200Fixed in 4.0.6
- ID
- WPSEC-2026-1845
- Plugin
- Payment Forms for Paystack (payment-forms-for-paystack)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Payment Forms for Paystack on WPSec AttackSurface
- Fix released
- Published
Description
The Payment Forms for Paystack plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin's Settings page in all versions up to, and including, 4.0.5 due to the page being registered with the 'edit_posts' capability and printing the stored Paystack secret API keys into the form field values. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the site's test and live Paystack secret keys, which could be used to access the merchant's Paystack account through the API.
References
- https://wpsec.com/vuln/WPSEC-2026-1845/
- https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/
- https://wordpress.org/plugins/payment-forms-for-paystack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS