CVE-2026-90923 in Autopay Plugin
Summary
by MITRE • 09/17/2026
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in versions of the Autopay WordPress plugin prior to release 5.0.1 represents a critical failure in input validation and cryptographic verification within the application's webhook handling logic. Specifically, the component responsible for processing payment callbacks from external gateways fails to verify the digital signature associated with incoming requests. In secure software architecture, webhooks are sensitive endpoints that trigger state-changing operations based on data received from third-party services. To ensure integrity and authenticity, these systems must validate that the payload originates from a trusted source by verifying a cryptographic signature generated using a shared secret key known only to the application server and the payment gateway. The absence of this verification step creates a severe security gap where any actor capable of sending HTTP requests can interact with this endpoint without authentication or proof of origin.
This technical flaw directly enables unauthenticated attackers to manipulate stored payment parameters associated with customer orders. By crafting malicious POST requests that mimic legitimate webhook payloads, an adversary can inject arbitrary data into the system's database. The impact is twofold: first, it allows for the disclosure of sensitive financial information belonging to other users, as the attacker can potentially read or modify order details such as transaction IDs, amounts, and customer identifiers stored in association with these payment parameters. Second, and more critically, the vulnerability permits the deletion of these records. An attacker can send a request that instructs the plugin to remove specific payment entries from the database, effectively erasing evidence of transactions or disrupting the accounting integrity for affected merchants. This capability undermines the reliability of financial reporting and order management systems built upon this platform.
From an industry standard perspective, this vulnerability is classified under CWE-347, which describes Improper Verification of Cryptographic Signature. It also aligns with CWE-285, indicating Improper Authorization, as the system fails to enforce proper access controls on a sensitive function. In terms of offensive security frameworks like MITRE ATT&CK, this behavior maps to T1078 Valid Accounts if authentication were bypassed through other means, but more accurately reflects T1496 Resource Hijacking or data manipulation techniques where an attacker alters system state for malicious purposes. The lack of signature verification is a classic example of trusting unverified input from external sources, which violates the fundamental principle of least privilege and zero trust architecture in API design.
The operational impact extends beyond immediate data loss to include potential reputational damage and financial liability for merchants using the plugin. If payment records are deleted or altered, it can lead to discrepancies in billing cycles, failed subscription renewals, and confusion regarding customer status. Furthermore, if sensitive personal information is exposed through parameter disclosure, the merchant may face compliance violations under regulations such as GDPR or PCI DSS, which mandate strict protection of cardholder data and personally identifiable information. The ease of exploitation due to the lack of authentication requirements means that automated scanning tools can rapidly identify and exploit this weakness across thousands of WordPress installations worldwide.
To mitigate this vulnerability, immediate action is required by upgrading the Autopay plugin to version 5.0.1 or later, where the signature verification logic has been properly implemented. Until an upgrade is possible, administrators should consider implementing a Web Application Firewall rule that restricts access to the specific webhook endpoint IP addresses known to belong to legitimate payment gateways. Additionally, enabling strict logging and monitoring for unusual POST requests to this endpoint can help detect attempted exploitation in real-time. Developers must ensure that all future integrations with external services adhere to secure coding practices by always validating cryptographic signatures and enforcing authentication checks on any callback mechanism that modifies system state or accesses sensitive data.