EUVD-2026-68060
GHSA-prcx-3pc2-2j8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AC:H reflects the mandatory out-of-band knowledge of a high-entropy, non-enumerable Stripe subscription ID; PR:L for required authenticated portal session; I:L for subscription cancellation only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers.
Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.
AnalysisAI
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a confirmed, active Stripe Payment Forms by WP Full Pay customer portal session - meaning they must be a registered, authenticated customer of the targeted WordPress site (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) is broadly consistent with the flaw's character: network-reachable (AV:N), low complexity in the mechanical sense (AC:L per NVD), requiring only a valid portal session (PR:L), with impact confined to low integrity loss (subscription cancellation, I:L) and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Stripe Payment Forms by WP Full Pay WordPress plugin to version 8.5.5 or later, which introduces server-side ownership verification before processing subscription cancellations; this is the only confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/e1b0e815-e803-4a14-ab2a-ed860e82c782/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any un
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and b
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today