CVE-2026-90923

The Autopay WordPress plugin before 5.0.1 fails to enforce the signature on one of its payment callbacks , enabling unauthenticated attackers to disclose and delete the stored payment parameters of other customers' orders — a cross-customer data integrity issue. The CVSS 3.1 score is 6.5 (Medium)...