# Payment Forms for Paystack <= 4.0.5 - Authenticated (Contributor+) Sensitive Information Exposure via Settings Page

- **ID:** WPSEC-2026-1845
- **Plugin:** Payment Forms for Paystack (`payment-forms-for-paystack`), https://wordpress.org/plugins/payment-forms-for-paystack/
- **Affected versions:** all versions before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1845/

## Description

The Payment Forms for Paystack plugin for WordPress is vulnerable to Sensitive Information Exposure via the plugin's Settings page in all versions up to, and including, 4.0.5 due to the page being registered with the 'edit_posts' capability and printing the stored Paystack secret API keys into the form field values. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the site's test and live Paystack secret keys, which could be used to access the merchant's Paystack account through the API.

## References

- https://wpsec.com/vuln/WPSEC-2026-1845/
- https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/
- https://wordpress.org/plugins/payment-forms-for-paystack/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1845/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.