WordPress Payment Forms for Paystack Plugin API Secret Key Disclosure Vulnerability (CVE-2026-110042)

1. Apply Official Patch

Log in to your WordPress Dashboard, navigate to the Plugins menu, and update Payment Forms for Paystack to version 4.0.6 or later.

2. Rotate API Credentials (Critical)

If you were running an affected version, assume your API keys are compromised. Perform the following steps:

• Log in to your Paystack Dashboard.
• Navigate to Settings > API Keys & Webhooks.
• Revoke the existing Live Secret Key and Test Secret Key and generate new ones.
• Update the new keys in your WordPress plugin settings.

3. Temporary Mitigation

If an immediate update is not feasible, temporarily demote untrusted users with the Contributor or Author roles, or restrict access to the admin panel using custom code in your theme's functions.php:

// Restrict Contributor access to the WordPress admin dashboard
add_action('admin_init', 'restrict_admin_with_redirect');
function restrict_admin_with_redirect() {
    if (defined('DOING_AJAX') && DOING_AJAX) return;
    if (current_user_can('contributor')) {
        wp_redirect(home_url());
        exit;
    }
}

Vulnerability Overview

A critical information disclosure vulnerability (CWE-200) due to broken access control has been identified in the Payment Forms for Paystack WordPress plugin. The plugin fails to properly restrict access to its configuration display page.

Exploit Mechanics & Root Cause

• Insufficient Authorization: The plugin does not enforce strict administrative privilege checks on the page displaying stored configuration settings.
• Credential Exposure: An authenticated user with a low-privilege role, such as a Contributor, can access this page and view both the live and test API secret keys in plaintext.
• Downstream Impact: Armed with these secret keys, an attacker gains full programmatic access to the site owner's Paystack merchant account, enabling unauthorized transactions, refunds, and financial theft.