CVE-2026-56024 is a CWE-352 Cross-Site Request Forgery vulnerability in the WP EasyPay plugin by Saad Iqbal. It affects all versions up to and including 4.4.0. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user without their consent. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and impacts on integrity and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause the WP EasyPay plugin to perform unintended actions, potentially affecting the integrity and availability of the affected system. There is no impact on confidentiality reported. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting access to trusted users. Monitor vendor channels for updates.