EUVD-2026-66288
GHSA-7q4v-225q-qmcp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth or interaction needed; impact confined to partial confidentiality loss of customer billing records, no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
AnalysisAI
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and billing data to unauthenticated network attackers due to a missing session-confirmation check in the customer portal workflow. The plugin returns sensitive financial records before verifying that a portal session has completed its confirmation step, enabling any unauthenticated user to read billing information belonging to a different customer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 Medium and accurately reflects the attack surface: fully network-reachable, zero prerequisites, but limited to confidentiality impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates WordPress sites running the vulnerable plugin (detectable via standard WordPress plugin fingerprinting) and sends a crafted unauthenticated request to the customer portal data-return endpoint, supplying a session identifier that has not completed the confirmation flow. The server responds with subscription details and billing records for the associated customer account. … |
| Remediation | Update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.1 or later; this is confirmed as the vendor-released patch per the WPScan advisory (https://wpscan.com/vulnerability/2d4fc012-9f80-43cc-b68d-96842700fe2f/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any un
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today