The WP EasyPay plugin, up to version 4.4.0, contains a CSRF flaw that allows an attacker to trick a logged‑in user into performing privileged operations without the user's intent. This weakness, classified as CWE‑352, can lead to the unauthorized execution of payment processing or other sensitive actions within the plugin.

WordPress sites that have installed Saad Iqbal’s WP EasyPay plugin version 4.4.0 or earlier are affected. Site administrators who have not upgraded beyond 4.4.0 expose their sites to this vulnerability.

The CVSS score of 6.5 indicates a moderate‑to‑high severity issue. The EPSS value is not available, so the likelihood of exploitation cannot be quantified from that metric, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need to target a user with a valid authenticated session, typically an administrator, and exploit the plugin’s web interface. With proper authentication and the ability to visit the plugin’s administrative pages, an attacker can craft a request that the plugin will accept as legitimate.