EUVD-2026-53725
GHSA-8673-2q96-2vmf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Nonce is publicly embedded on every payment form page requiring no credentials; payment amount manipulation via Stripe API constitutes high integrity impact with no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor - using a nonce that is embedded in every public page containing a payment form - to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.
AnalysisAI
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Stripe Payment Forms by WP Full Pay plugin installed and active at a version below 8.5.2, and at least one payment form must be embedded on a publicly accessible page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately reflects a network-exploitable, zero-complexity, unauthenticated attack with high integrity impact - the ability to manipulate payment amounts is a direct financial harm. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker visits any public page of the target WordPress store that contains a WP Full Pay payment form, extracts the WordPress nonce value embedded in the page HTML, and then submits a crafted unauthenticated HTTP POST request to the site's wp-admin/admin-ajax.php endpoint targeting the unprotected pricing-recalculation or payment-intent-update AJAX action, specifying an existing Stripe payment intent ID (obtainable by initiating a legitimate checkout flow) along with a manipulated price. A publicly available proof-of-concept documents the exact request structure, making this trivially scriptable. |
| Remediation | Update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.2 or later immediately; this is the only confirmed complete fix per the vendor and WPScan (https://wpscan.com/vulnerability/5fcb5b11-3ebd-4821-aa6f-c6be70bac395/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress instances running Stripe Payment Forms by WP Full Pay by checking the wp-content/plugins directory or admin dashboard; if version 8.5.1 or earlier is confirmed, disable the plugin or restrict payment form access pending update. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today