EUVD-2026-71855
GHSA-4qcx-xfr8-6hf6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable checkout endpoint, no account required beyond customer role, low integrity impact (product substitution), no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.
AnalysisAI
Order-integrity bypass in the Accept Stripe Payments WordPress plugin before 2.1.4 allows unauthenticated customers who complete a genuine Stripe payment to receive fulfillment for a different product than the one they purchased. The plugin validates only that the payment amount is at least the referenced product's price at checkout completion, without verifying that the fulfilled product matches the product for which payment was originally captured. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to complete a genuine Stripe payment using a valid payment method - there is no way to obtain goods without spending money. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects limited integrity impact: the attacker cannot obtain goods for free - a genuine Stripe payment must be completed - meaning financial exposure is bounded to the price difference between the paid and fulfilled products, and only equal- or lower-priced substitution is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Accept Stripe Payments WordPress plugin to version 2.1.4 or later, which is a vendor-released patch confirmed by WPScan and EUVD-2026-71855. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Accept Stripe Payments
View allWordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated a
Open redirect in the Accept Stripe Payments WordPress plugin before version 2.1.4 enables unauthenticated attackers to c
Share
External POC / Exploit Code
Leaving vuln.today