WP Full Pay CVE-2026-16734

The target WordPress site must have the Stripe Payment Forms by WP Full Pay plugin installed and active at a version below 8.5.2, and at least one payment form must be embedded on a publicly accessible page. The nonce required to call the AJAX endpoints is automatically embedded in the rendered HTML of any such page, so the attacker only needs to be able to load a page containing a payment form - no account, no login, and no prior knowledge beyond the site URL is required. To manipulate a specific payment intent, the attacker must also supply a valid Stripe payment intent ID, which is obtainable by initiating a normal checkout flow as an anonymous visitor. Exploitation is constrained to payment amount manipulation (integrity impact only): there is no code execution, no access to stored credentials or customer data, and no availability impact. Sites that have no public payment forms or have already upgraded to 8.5.2 are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately reflects a network-exploitable, zero-complexity, unauthenticated attack with high integrity impact - the ability to manipulate payment amounts is a direct financial harm. The low EPSS (0.13%, 3rd percentile) appears to reflect limited observed scanning or exploitation traffic at the time of scoring, but should not be treated as a strong safety signal: the SSVC assessment marks the vulnerability as automatable (yes) with partial technical impact and POC-level exploitation status, meaning a scripted attack against any site in the wild is straightforward. The publicly available exploit further lowers the barrier. The more meaningful risk limiter is deployment context: only WordPress sites running this specific plugin with active payment forms are in scope. There is no CISA KEV listing, so confirmed active in-the-wild exploitation is not established at this time - but the combination of public POC, automatable exploitation, and direct financial impact warrants urgent patching over EPSS-based deferral.

An attacker visits any public page of the target WordPress store that contains a WP Full Pay payment form, extracts the WordPress nonce value embedded in the page HTML, and then submits a crafted unauthenticated HTTP POST request to the site's wp-admin/admin-ajax.php endpoint targeting the unprotected pricing-recalculation or payment-intent-update AJAX action, specifying an existing Stripe payment intent ID (obtainable by initiating a legitimate checkout flow) along with a manipulated price. A publicly available proof-of-concept documents the exact request structure, making this trivially scriptable.