EUVD-2026-66289
GHSA-wq46-399w-9f66
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L reflects required authenticated customer session; integrity-only impact as subscription state is altered but no data is read or service disrupted.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, confirmed customer portal session on the targeted WordPress merchant site - meaning the attacker must be a registered customer (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3 (Medium), appropriately reflecting that exploitation requires a low-privilege authenticated session and produces only integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds a legitimate customer account on a WordPress-hosted merchant site using WP Full Pay, obtaining a valid customer portal session. By intercepting or crafting portal requests and substituting other customers' Stripe subscription IDs (obtained via enumeration or prior reconnaissance), the attacker submits cancellation or modification actions that the plugin processes without ownership verification. … |
| Remediation | Update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.1 or later, which is the vendor-released patch addressing this authorization flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any un
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and b
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today