CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 fails to enforce the signature on one of its payment callbacks. This allows unauthenticated users to disclose and delete the stored payment parameters belonging to other customers' orders, constituting a cross-customer data integrity and confidentiality i...