The WP Easy Pay – Payment and Donation form Builder for Square WordPress plugin suffers from a missing authorization check (CWE-862) in all versions up to 4.5.0. Authenticated users with subscriber-level privileges or above can exploit this vulnerability to set the status of arbitrary posts and pages to 'draft', thereby unpublishing content without proper permission. This occurs because the plugin fails to verify that the user is authorized to perform the status change action. No official patch or remediation has been documented as of the publication date.

An attacker with subscriber-level access or higher can unpublish arbitrary posts and pages by changing their status to 'draft'. This results in unauthorized content modification, potentially disrupting website availability and content integrity. There is no indication of confidentiality or availability impact beyond content unpublishing. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only, and monitor for unauthorized content status changes. Avoid granting subscriber-level or higher access to untrusted users.