CVE-2026-12739

Name of the Vulnerable Software and Affected Versions WP Easy Pay – Payment and Donation form Builder for Square versions prior to 4.5.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently delete arbitrary posts, pages, and custom post types by bypassing the trash via force deletion, or change the status of any published post to draft.

Recommendations Update the plugin to a version newer than 4.5.0.