CVE-2026-84762: CWE-472 External Control of Assumed-Immutable Web Parameter in Saad Iqbal WP EasyPay

This vulnerability, identified as CWE-472, affects WP EasyPay up to version 4.5.3 and allows unauthenticated attackers to bypass certain controls by externally manipulating web parameters that the application assumes to be immutable. The CVSS 3.1 base score is 5.3, indicating a medium impact primarily on integrity with no confidentiality or availability impact. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

The vulnerability impacts the integrity of the WP EasyPay plugin by allowing attackers to bypass controls through manipulation of web parameters without authentication. There is no direct impact on confidentiality or availability. This could lead to unauthorized actions or data manipulation within the affected plugin's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation or workaround is provided at this time.