WP Full Stripe Free CVE-2026-42378

Exploitation requires the attacker to hold a valid subscriber-level (or higher) WordPress user account on the target site - this is the sole prerequisite. On WordPress sites with open user registration enabled (the default on many installations), any internet user can self-register to obtain this access level. On closed-registration sites, the attacker must already possess credentials for any valid account. The plugin WP Full Stripe Free version 8.4.1 or earlier must be installed and active. No specific plugin feature or non-default configuration mode is identified in the available data as a prerequisite - the vulnerability appears to exist in the plugin's standard authentication handling. Exploitation is limited to information disclosure (C:H, I:N, A:N); there is no indication of write or destructive capability. No physical access, specific platform variant, or additional privilege is required beyond the subscriber account.

The NVD CVSS 3.1 score is 6.5 (Medium), with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The PR:L metric is the critical limiting factor - exploitation requires a subscriber-level WordPress account, which on sites with open user registration represents a very low barrier; on private or closed-registration sites, the attacker must first obtain or possess credentials. Attack complexity is low (AC:L) with no user interaction, meaning once credentials are available, exploitation is straightforward. The Confidentiality impact is rated High (C:H), consistent with potential exposure of Stripe payment data, customer records, or subscription information - data with direct regulatory and financial implications. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be assessed quantitatively. The vulnerability is not listed in CISA KEV, and no public POC has been identified, both of which reduce immediate urgency. However, WordPress plugin vulnerabilities of this class are historically popular targets due to the large install base and the low sophistication required once a subscriber account is obtained. Sites with open user registration should treat this as higher priority than the raw score implies.

An attacker targeting a WordPress e-commerce site running WP Full Stripe Free registers a free subscriber account (or uses a previously obtained low-privilege credential) and then directly invokes a plugin REST API endpoint or AJAX action that lacks proper capability verification, retrieving Stripe customer records, subscription identifiers, or payment metadata for other site users. No public POC has been identified, but the low complexity (AC:L) and well-understood WordPress plugin authentication bypass pattern make independent reproduction feasible for a moderately skilled attacker.