Live › vulnerability › CVE-2026-39734
WP EasyPay, a WordPress payment plugin, has a path traversal flaw in versions up to 4.5.4. Per the advisory summary, an unauthenticated visitor can use it to reach files outside the intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
WordPress sites running WP EasyPay version 4.5.4 or earlier. The flaw needs no login, so any site with the plugin active is reachable; sites without the plugin are not affected. The sources do not describe the exact vulnerable code path or default configuration.
No product ranges from the sources yet.
4.5.44.5.4; the sources do not name the exact fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-39734")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.