CVE-2021-4411

Name of the Vulnerable Software and Affected Versions WP EasyPay – Square for WordPress plugin versions up to, and including, 3.2.0

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpep download transaction in excel() function. This allows unauthenticated attackers to trigger a transactions download via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For WP EasyPay – Square for WordPress plugin versions up to, and including, 3.2.0, consider disabling the wpep download transaction in excel() function until a patch is available to prevent exploitation.