Live › vulnerability › CVE-2026-110042
The Payment Forms for Paystack WordPress plugin before 4.0.6 has a page that shows its stored configuration without proper access checks. A logged-in user with the Contributor role or higher can read the live and test Paystack secret keys, which give full control of the site owner's payment account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Payment Forms for Paystack WordPress plugin before 4.0.6 that have users with the Contributor role or higher. Sites without this plugin, or with it at 4.0.6 or later, are not affected. Users limited to Subscriber or Author-free roles are not expected to reach the page, but the sources do not detail the exact capability check.
No product ranges from the sources yet.
4.0.6 are in scope.4.0.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.
This page as .md · .json · in your agent: get_signal("CVE-2026-110042")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.