WordPress WP SmartPay plugin contains an authentication bypass flaw that allows an attacker to gain unauthorized access by following an alternate path or channel. The vulnerability is classified as CWE‑288, indicating improper authentication. Successful exploitation results in an attacker taking control of a user account, potentially with full site privileges, leading to data theft, site manipulation, or further compromise.

Convers Lab’s WP SmartPay plugin for WordPress, versions up through 2.7.13, is affected. Any WordPress site that has not upgraded beyond this version could be vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves sending a crafted HTTP request to an alternate endpoint within the WordPress site to bypass authentication. An attacker with network access to the site can execute this bypass remotely, potentially enabling account takeover.