What is the CVSS score of CVE-2026-6627?

CVE-2026-6627 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.6%.

Which versions of WPFormify are affected by CVE-2026-6627?

WPFormify - Stripe Payments plugin (versions ≤ 1.1.1) contains a critical unauthenticated vulnerability allowing remote attackers to overwrite Stripe API credentials and redirect customer payments to…

How to fix or mitigate CVE-2026-6627?

Within 24 hours: Disable the WPFormify plugin on all WordPress instances and immediately rotate all Stripe API keys. Conduct an urgent audit of Stripe account activity logs for the past 30 days to identify unauthorized credential changes, payment routing modifications, or suspicious transactions. Within 7 days: Deploy an alternative payment processor (WP Commerce, Stripe native integration, or WooCommerce Payments) to restore payment processing. Perform a complete forensic review of all transactions processed during the vulnerability exposure period to quantify and remediate fraudulent payments. Within 30 days: Establish a mandatory plugin security vetting process requiring security review before WordPress plugin deployment, implement automated vulnerability scanning via WPScan or similar tools, and develop a payment system compromise incident response runbook with 24-hour activation procedures.

WPFormify CVE-2026-6627

EUVD-2026-53173 HIGH

Missing Authorization (CWE-862)

2026-08-05 Wordfence

GHSA-hww4-pj88-89c3

PHP WordPress Authentication Bypass Wordpress Plugin Wpformify Stripe Payments With Form And Checkout Saadiqbal

8.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Endpoint is network-accessible without authentication; credentials are overwritten not disclosed, so C:N; payment disruption is partial and bounded, so A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:47 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

HIGH 8.2

DescriptionCVE.org

The WPFormify - Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the wpf_stripe_callback_success() and wpf_stripe_disconnect() functions, both hooked to admin_init. The admin_init hook fires on admin-post.php which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.

AnalysisAI

Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's admin_init hook are reachable via the publicly accessible admin-post.php endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.

Technical ContextAI

WordPress's admin_init hook fires not only during authenticated admin sessions but also when admin-post.php is loaded - a publicly accessible endpoint used for plugin-driven form processing. Plugins that register handlers on admin_init without guarding them with current_user_can() capability checks and nonce verification inadvertently expose those handlers to unauthenticated HTTP callers. In this case, wpf_stripe_callback_success() (stripe_authorization.php line 49) and wpf_stripe_disconnect() (line 79) perform sensitive write and delete operations on stored Stripe API credentials without any authorization gate. CWE-862 (Missing Authorization) is the precise root cause class. The affected CPE is cpe:2.3:a:saadiqbal:wpformify_-_stripe_payments_with_form_and_checkout:*:*:*:*:*:*:*:*, covering all releases through 1.1.1. The vulnerable source is directly browsable in the WordPress plugin repository.

RemediationAI

Upgrade WPFormify to version 1.1.2 or later immediately; the fix is confirmed by the WordPress SVN changeset at https://plugins.trac.wordpress.org/changeset?new=3557764%40wpformify%2Ftags%2F1.1.2&old=3299310%40wpformify/tags, which reflects corrections to stripe_authorization.php. If an immediate upgrade is operationally blocked, a compensating control is to restrict unauthenticated POST requests to wp-admin/admin-post.php at the web server or WAF layer - note that this may break other plugins that legitimately depend on that endpoint, so the change must be tested in staging before production deployment. Following upgrade or mitigation, administrators should immediately audit their Stripe dashboard for unauthorized API key additions or unexpected connected accounts, and should proactively rotate their Stripe API keys as a precaution even without confirmed compromise.