WP Full Pay CVE-2026-77758

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. The target WordPress site must have the Stripe Payment Forms by WP Full Pay plugin installed and activated in a version prior to 8.5.1, and the customer portal feature must be in use (i.e., at least one customer has initiated a portal session). Exploitation is limited to reading other customers' subscription and billing data (confidentiality only); no write or availability impact is possible. The attacker must be able to reach the WordPress site over the network, but no special network position is required. The attack is limited to sites that actually process Stripe subscriptions through this specific plugin.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 Medium and accurately reflects the attack surface: fully network-reachable, zero prerequisites, but limited to confidentiality impact only. EPSS at 0.18% (7th percentile) is low, which is notable given a public POC already exists - this divergence suggests the exploit has not yet been widely used in automated campaigns, possibly because the plugin has a narrower deployment footprint than mass-targeted software. The vulnerability is not listed in CISA KEV, so active exploitation is not confirmed. The real-world risk is disproportionate to the CVSS score for any site processing real customer payment data: exposure of subscription and billing records constitutes financial PII with GDPR and PCI-DSS compliance implications. Even a small e-commerce operator running this plugin faces regulatory exposure if customer billing records are read by unauthorized parties. The risk priority should be elevated above the raw score for any site with active paying customers.

An attacker enumerates WordPress sites running the vulnerable plugin (detectable via standard WordPress plugin fingerprinting) and sends a crafted unauthenticated request to the customer portal data-return endpoint, supplying a session identifier that has not completed the confirmation flow. The server responds with subscription details and billing records for the associated customer account. A public exploit is available per WPScan intelligence, lowering the skill bar for this attack.