WPForms CVE-2026-74991

Requires a WordPress site running WPForms (before 2.0.2) with Stripe payment integration active, and the site owner's Stripe account must also process payments for other applications (whose payment/subscription objects become the targets). Exploitation is remote and unauthenticated via a normal public form submission (PR:N/UI:N), but is limited by AC:H: the attacker must supply a specific, valid Stripe payment object identifier belonging to another application on that account - the vulnerability does not let an attacker enumerate or discover those IDs, so success depends on already knowing a legitimate payment/subscription reference. Impact is confined to refunding payments and cancelling subscriptions (integrity); there is no data disclosure.

This is a genuine but moderate-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N = 6.8) is internally consistent with the description: unauthenticated network reachability via a public form submission (PR:N/UI:N), but AC:H because the attacker must supply a valid Stripe payment object identifier belonging to another application on the owner's account - that dependency on obtaining/guessing a legitimate payment reference is a real barrier, not attacker-controlled. Impact is integrity-only (I:H: unauthorized refunds and subscription cancellations) with no confidentiality or availability effect, and S:C reflects that the damage crosses into a separate security authority (the owner's Stripe account and unrelated applications billing through it). The signals partly diverge: a public POC exists (WPScan) and a patch is available, yet SSVC records Exploitation=none, Automatable=no, Technical Impact=partial, and there is no EPSS score or CISA KEV listing provided. So exploit code is public but there is no evidence of active exploitation, and the AC:H plus non-automatable nature argues against opportunistic mass abuse - realistic risk is targeted financial sabotage against a specific site whose Stripe payment references an attacker can learn. Net: patch promptly on high-value/e-commerce sites, but this is not a wormable, drive-by threat.

An attacker who has obtained a valid Stripe payment or subscription object ID tied to the site owner's Stripe account (e.g., from another application billing through that same account) submits a crafted public WPForms form that references that object. Because the plugin never verifies the payment object belongs to it, the request triggers a full refund and immediate subscription cancellation. A public proof-of-concept is available via WPScan, though there is no indication of active exploitation.