{
 "id": "WPSEC-2026-1845",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1845/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1845/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1845/index.md",
 "title": "Payment Forms for Paystack <= 4.0.5 - Authenticated (Contributor+) Sensitive Information Exposure via Settings Page",
 "description": "The Payment Forms for Paystack plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin's Settings page in all versions up to, and including, 4.0.5 due to the page being registered with the 'edit_posts' capability and printing the stored Paystack secret API keys into the form field values. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the site's test and live Paystack secret keys, which could be used to access the merchant's Paystack account through the API.",
 "plugin": {
  "slug": "payment-forms-for-paystack",
  "name": "Payment Forms for Paystack",
  "full_name": "Payment Forms for Paystack",
  "wordpress_org": "https://wordpress.org/plugins/payment-forms-for-paystack/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payment-forms-for-paystack/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.6",
 "remediation": "Update to 4.0.6 or later.",
 "fix_released": "2026-10-27T14:17:11+00:00",
 "published": "2026-10-28T14:51:26+00:00",
 "updated": "2026-10-28T09:20:17.383663+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1845/",
  "https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/",
  "https://wordpress.org/plugins/payment-forms-for-paystack/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}