{"id":"CVE-2026-110042","kind":"vulnerability","aliases":["CVE-2026-110042"],"related":[],"title":"WordPress Paystack payment plugin exposes live and test secret keys to contributors","description":"The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.","summary":"The Payment Forms for Paystack WordPress plugin before 4.0.6 has a page that shows its stored configuration without proper access checks. A logged-in user with the Contributor role or higher can read the live and test Paystack secret keys, which give full control of the site owner's payment account.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","paystack","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-at-4.0.6-or-later"],"how_to_check":"- Check the installed version of the Payment Forms for Paystack plugin in the WordPress admin plugins list; versions below `4.0.6` are in scope.\n- Review which accounts hold the Contributor role or higher on the site.","fix":"- Payment Forms for Paystack: move to `4.0.6` or later.","status":"open","published_at":"2026-10-31T06:16:32+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:32+00:00","updated_at":"2026-10-31T06:34:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:32Z","model":"claude-haiku-5-5","output":{"fix":"- Payment Forms for Paystack: move to `4.0.6` or later.","reach":"network","title":"WordPress Paystack payment plugin exposes live and test secret keys to contributors","impact":"high","summary":"The Payment Forms for Paystack WordPress plugin before 4.0.6 has a page that shows its stored configuration without proper access checks. A logged-in user with the Contributor role or higher can read the live and test Paystack secret keys, which give full control of the site owner's payment account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","paystack","payments"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads live Paystack secret keys and controls the payment account","analyst_note":"Confirm the exact vulnerable page and capability check from the NVD entry or the plugin changelog for 4.0.6.","how_to_check":"- Check the installed version of the Payment Forms for Paystack plugin in the WordPress admin plugins list; versions below `4.0.6` are in scope.\n- Review which accounts hold the Contributor role or higher on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-at-4.0.6-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Payment Forms for Paystack WordPress plugin before 4.0.6 that have users with the Contributor role or higher. Sites without this plugin, or with it at 4.0.6 or later, are not affected. Users limited to Subscriber or Author-free roles are not expected to reach the page, but the sources do not detail the exact capability check.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4121,"output_tokens":612,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110042':15A,18A '-2026':14A,17A '4.0.6':31B,83C 'access':42B,88C,123C 'account':74B,130C 'allow':97C 'api':111C 'check':43B 'configur':39B,96C 'contributor':12A,51B,101C 'control':67B 'credenti':112C 'cve':13A,16A 'display':93C 'expos':5A 'form':25B,77C 'full':66B,122C 'gateway':110C 'give':65B 'grant':121C 'higher':54B 'key':10A,63B,119C 'live':6A,58B,115C 'log':46B 'logged-in':45B 'owner':71B,127C 'packag':19B 'page':34B,91C 'payment':3A,20B,24B,73B,76C,109C,129C 'payment-gateway':108C 'paystack':2A,21B,27B,61B,79C 'plugin':4A,29B,81C 'proper':41B,86C 'read':56B 'restrict':87C 'role':52B,102C 'secret':9A,62B,107C,118C 'show':36B 'site':70B,126C 'store':38B,95C 'test':8A,60B,117C 'user':48B,98C 'view':106C 'without':40B 'wordpress':1A,22B,28B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Payment Forms for Paystack WordPress plugin before 4.0.6 that have users with the Contributor role or higher. Sites without this plugin, or with it at 4.0.6 or later, are not affected. Users limited to Subscriber or Author-free roles are not expected to reach the page, but the sources do not detail the exact capability check.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110042","severity":null,"published_at":"2026-10-31T06:16:32+00:00","modified_at":"2026-10-31T06:16:32+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}