CVE-2025-49340

WordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

View on CVE.org
Published Dec 31, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

Analysis

AI-generated

Technical impact

Direct Payments WP fails to safeguard sensitive data embedded in its responses, permitting unauthorized actors to retrieve that data. The vulnerability is identified as CWE‑497, allowing a moderate breach of confidentiality for the WordPress site and its users.

Affected Systems

This flaw affects the Digages Direct Payments WP plugin for WordPress versions up to and including 1.3.2. Administrators who have installed any of these versions are potentially exposed.

Risk and Exploitability

The CVSS score of 4.3 reflects a moderate risk level, and the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could obtain the exposed sensitive data by accessing the plugin’s publicly exposed pages or API endpoints, which are typically reachable from the web. This suggests the attack surface is moderate, but the lack of additional exploitation details limits a precise assessment of attack feasibility.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Direct Payments WP plugin to a version newer than 1.3.2 if available.
  • If a newer version does not exist, disable or remove the plugin from the WordPress installation.
  • Audit logs, caches, or stored data for any sensitive information that may have been exposed by the plugin and purge it.
  • Apply network or application layer controls to restrict access to the plugin’s public pages or API endpoints until the vulnerability is resolved.

Generated by OpenCVE AI on April 30, 2026 at 14:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.3. Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.
Title WordPress Direct Payments WP plugin <= 1.3.3 - Sensitive Data Exposure vulnerability WordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerability
Type Values Removed Values Added
Description Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2. Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.3.
Title WordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerability WordPress Direct Payments WP plugin <= 1.3.3 - Sensitive Data Exposure vulnerability
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
Description Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through 1.3.0. Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.
Title WordPress Direct Payments WP plugin <= 1.3.0 - Sensitive Data Exposure vulnerability WordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerability
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through 1.3.0.
Title WordPress Direct Payments WP plugin <= 1.3.0 - Sensitive Data Exposure vulnerability
Weaknesses CWE-497
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}
Earlier changes (3)
Weaknesses
  • CWE-497

    Exposure of Sensitive System Information to an Unauthorized Control Sphere

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Jun 4, 2025, 9:42 AM

View source JSON

Updated
Dec 31, 2025, 5:33 PM

JSON

Status
Deferred
Published
Dec 31, 2025, 5:15 PM
Modified
Sep 28, 2026, 10:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 2:30 PM

JSON