WPFormify CVE-2026-6627

Exploitation requires only that the WPFormify plugin (version 1.1.1 or earlier) is installed and active on a WordPress site - no authentication, no elevated role, no non-default configuration, and no specific deployment mode is needed. The admin-post.php endpoint is publicly accessible on all standard WordPress installations. The payment-diversion attack path additionally requires the attacker to possess a valid Stripe account to receive the diverted funds; the credential-deletion path (service disruption) has no such requirement. No user interaction is required. Scope is limited to WordPress sites actively running this plugin with Stripe integration configured.

The CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) is an accurate representation of real-world risk. The high integrity score reflects a genuinely severe business impact: silent payment diversion can persist across many transactions before detection, causing direct financial harm to both site operators and customers. The low availability score captures the credential-deletion attack path, which disables the checkout flow. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from that signal; however, AC:L and PR:N together indicate the attack requires no special tooling or knowledge beyond knowing the admin-post.php action parameter - making it broadly executable. No CISA KEV listing and no confirmed POC exist at time of analysis, distinguishing this from actively weaponized vulnerabilities. The primary limiting factor on aggregate exposure is the niche install base of this specific plugin. Any site that does run it should treat remediation as urgent because the fraud impact materializes silently.

An attacker sends an unauthenticated POST request to wp-admin/admin-post.php targeting the action bound to wpf_stripe_callback_success(), supplying their own Stripe publishable and secret API keys as parameters. WordPress processes the request without authenticating the caller, overwrites the site's stored Stripe credentials, and all subsequent customer checkout transactions are silently routed to the attacker's Stripe account. The attack leaves no immediately visible disruption to the site's checkout flow, potentially allowing the fraud to continue undetected across many transactions.