CVE-2025-3851

Name of the Vulnerable Software and Affected Versions WP SmartPay plugin for WordPress versions 1.1.0 through 2.7.13

Description The issue allows authenticated attackers with Subscriber-level access and above to view other users' data, including email addresses, names, and notes, due to missing validation on a user-controlled key in the show() function.

Recommendations For WP SmartPay plugin for WordPress versions 1.1.0 through 2.7.13, consider disabling the show() function until a patch is available to prevent exploitation. Restrict access to sensitive user data to minimize the risk of unauthorized access.