CVE-2026-66444

This CVE exposes a broken access control failure (CWE-639) in the Paystack WordPress plugin, not a design ambiguity. A subscriber-level authenticated user — the lowest privilege role in WordPress — can access payment form data belonging to other users through normal application flows. This is not a subtle exploit chain or a reflected XSS; it's an authorization check that should have been enforcing user-scoped data boundaries at the point where payment forms render. The vulnerability affects versions through 4.0.5, with the fix landing in 4.0.6. The most likely remediation is a three-line change: validate that the subscriber ID in the payment form context matches the requesting session. This is a surgical implementation bug — the library was passing subscriber context into payment form rendering without scoping that context to the current user. The medium severity and low EPSS score reflect that the exploit path isn't trivially obvious to external attackers. But the data category (payment-related) carries regulatory weight under PCI-DSS regardless of exploitability. The fact that the exposure happens through normal application flows — not through an attacker-controlled payload — actually increases compliance implications because it means the vulnerability exists within the expected usage model. For defenders: audit your WordPress installations for the Paystack plugin versions <= 4.0.5 and upgrade immediately. Review your access logs for any subscriber-role requests accessing /payment-form endpoints or API routes that return payment-related data. The key indicator is subscriber-level users making requests that return data arrays — check for unexpected cardinality in responses where only one record should be present. If you cannot upgrade immediately, the interim mitigation is to restrict subscriber-role capabilities or route payment form rendering through a middleware that explicitly re-validates session-user consistency.

Reviewed through automated stages and approved by a human before publication.