Dashboard / CVE-2026-110042

CVE-2026-110042

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2026-10-31 Modified: 2026-11-02 First seen: 2026-10-31 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: None
A: None

Description

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown Payment Forms for Paystack 0 < 4.0.6
Unknown Payment Forms for Paystack 0 < 4.0.6

References & Advisories (1)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.29%
Raw Score 0.002890
Percentile 21.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00289
2026-11-12
0.00289
2026-11-10
0.00289
2026-11-09
0.00289
2026-11-08
0.00289
2026-11-07
0.00289
2026-11-06
0.00289
2026-11-05
0.00289
2026-11-04
0.00289
2026-11-03
0.00289
2026-11-02
0.00289
2026-11-01
0.00150
2026-10-31
0.00150

Intelligence Sources

mitre ref →
nvd ref →

External Links