WP SecureSubmit
WP SecureSubmit has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
None of the 2 issues recorded for WP SecureSubmit have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Kévin Mosbahi (Mika). WP SecureSubmit is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2024-56270WP SecureSubmit <= 1.5.18 - Unauthenticated Sensitive Information Exposure
Read the full analysisVulnerability Records
WP SecureSubmit
Author
SecureSubmit
SecureSubmit makes it simple to start taking tokenized, PCI-Friendly payments (no card data ever touches your web server in any way) without making your visitors leave your site and without using iFrames. Features of SecureSubmit: Only two configuration fields: public and secret API key Simple to isntall and configure “Buy Now” options supported “Donate Now” is default, tagless option Fully supported by Global Payments Available as a form or as a modal window Tag Options modal=”true/false” productid=”value” (this is required for non-donation) productname=”value” buttontext=”value” requirebilling=”value” requireshipping=”value” productimage=”value” (default is a picture of a gift box)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C