Public vulnerability disclosure

CVE-2026-110042

publishedCWE-200

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.

Investigate in Cyber JSON Markdown

Technical severity4.9 mediumCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Published2026-10-31Source updated 2026-11-01

Collected2026-11-021 attributed source

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

No affected-product ranges reported in collected sources.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 4.9 medium	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N`	NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/[email protected]