{"id":"CVE-2026-39734","kind":"vulnerability","aliases":["CVE-2026-39734"],"related":[],"title":"WP EasyPay WordPress plugin: unauthenticated path traversal flaw","description":"Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.","summary":"WP EasyPay, a WordPress payment plugin, has a path traversal flaw in versions up to 4.5.4. Per the advisory summary, an unauthenticated visitor can use it to reach files outside the intended directory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-easypay"],"not_affected_if":["plugin-not-installed","plugin-version-above-4.5.4"],"how_to_check":"- Check the installed WP EasyPay plugin version in the WordPress admin Plugins screen against `4.5.4`","fix":"- Move WP EasyPay to a version later than `4.5.4`; the sources do not name the exact fixed release","status":"open","published_at":"2026-10-30T19:18:24+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:25:57+00:00","updated_at":"2026-10-30T19:25:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move WP EasyPay to a version later than `4.5.4`; the sources do not name the exact fixed release","reach":"internet","title":"WP EasyPay WordPress plugin: unauthenticated path traversal flaw","impact":"medium","summary":"WP EasyPay, a WordPress payment plugin, has a path traversal flaw in versions up to 4.5.4. Per the advisory summary, an unauthenticated visitor can use it to reach files outside the intended directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-easypay","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads arbitrary files from the WordPress server","analyst_note":"Check NVD and the plugin's changelog for the fixed version and whether the traversal allows reads, writes or only limited file access.","how_to_check":"- Check the installed WP EasyPay plugin version in the WordPress admin Plugins screen against `4.5.4`\n- unknown beyond that: the sources do not give a specific file path or endpoint to inspect","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-4.5.4"],"who_is_affected":"WordPress sites running WP EasyPay version 4.5.4 or earlier. The flaw needs no login, so any site with the plugin active is reachable; sites without the plugin are not affected. The sources do not describe the exact vulnerable code path or default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4052,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-39734':11A,14A '4.5.4':38B,62C 'advisori':41B 'cve':9A,12A 'directori':55B 'easypay':2A,22B,24B,61C 'file':51B 'flaw':8A,33B 'host':18B 'intend':54B 'outsid':52B 'packag':15B 'path':6A,31B,57C 'payment':27B 'per':39B 'plugin':4A,28B 'reach':50B 'self':17B 'self-host':16B 'summari':42B 'travers':7A,32B,58C 'unauthent':5A,44B,56C 'use':47B 'version':35B,63C 'visitor':45B 'wordpress':3A,19B,26B 'wp':1A,21B,23B,60C 'wp-easypay':20B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running WP EasyPay version 4.5.4 or earlier. The flaw needs no login, so any site with the plugin active is reachable; sites without the plugin are not affected. The sources do not describe the exact vulnerable code path or default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39734","severity":null,"published_at":"2026-10-30T19:18:24+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}