CVE-2026-110042

{"id": "CVE-2026-110042", "cveTags": [], "metrics": {}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Payment Forms for Paystack", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-31T06:16:32.120", "references": [{"url": "https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/", "source": "contact@wpscan.com"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account."}], "lastModified": "2026-10-31T06:16:32.120", "sourceIdentifier": "contact@wpscan.com"}