What is the CVSS score of EUVD-2026-39957?

EUVD-2026-39957 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

WP Full Stripe Free EUVD-2026-39957

| CVE-2026-12432 MEDIUM

Missing Authorization (CWE-862)

2026-06-27 Wordfence

GHSA-26qv-fwp4-4p47

WordPress Authentication Bypass Wordpress Plugin Stripe Payment Forms By Wp Full Pay Accept Credit Card Payments Donations Subscriptions Themeisle

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated AJAX endpoint; low complexity since Payment Intent IDs are routinely exposed to browsers; integrity-only impact limited to payment record manipulation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:53 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this->db->updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js checkout flows) to manipulate payment records in the site's database, marking previously successful payments as failed and overwriting failure codes and messages with attacker-supplied values.

AnalysisAI

Payment record manipulation in the WP Full Stripe Free WordPress plugin (versions ≤ 8.4.3) allows unauthenticated remote attackers to overwrite payment status in the site database. The vulnerability stems from the wpfs_update_failed_payment_status AJAX handler being registered under both wp_ajax_ and wp_ajax_nopriv_ hooks with zero authorization controls - no capability check, no nonce, no session validation - enabling any caller to invoke it. An attacker who has legitimately initiated a checkout on the target site (and thereby obtained a Stripe Payment Intent ID from the browser-visible Stripe.js flow) can send a crafted POST request to mark a previously successful payment as failed, potentially blocking order fulfillment, triggering disputes, or corrupting financial records. No public exploit code has been identified at the time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

WP Full Stripe Free (vendor: Themeisle; CPE: cpe:2.3:a:themeisle:stripe_payment_forms_by_wp_full_pay_-_accept_credit_card_payments,_donations_&_subscriptions:*:*:*:*:*:*:*:*) integrates Stripe's JavaScript SDK (Stripe.js) into WordPress to handle payments and subscriptions. WordPress AJAX endpoints are registered as wp_ajax_{action} for authenticated users and wp_ajax_nopriv_{action} for unauthenticated users; registering a handler under both hooks, as this plugin does for wpfs_update_failed_payment_status, exposes the action to the entire internet. CWE-862 (Missing Authorization) describes this precisely: a functionality that modifies protected resources (payment database records) fails to verify that the caller is permitted to perform the operation. The vulnerable code path is traceable in the plugin's SVN repository at wpfs-customer.php (lines 706, 3840, 3865 in tags 8.4.1 and 8.4.3) and wpfs-database.php (line 2652), where update_failed_payment_status() passes attacker-controlled POST parameters directly to $this->db->updatePaymentByEventId() without any gatekeeping. The 'secret' prerequisite - a Stripe Payment Intent ID - is not a security token; it is routinely transmitted to customer browsers during normal Stripe.js checkout initialization and is therefore accessible to any visitor who has started a checkout on the site.

RemediationAI

Upstream fix available via WordPress plugin SVN changeset 3584355 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3584355%40wp-full-stripe-free&new=3584355%40wp-full-stripe-free); a specific released patched version number is not independently confirmed from the available data - verify the latest version in the WordPress plugin directory and update immediately beyond 8.4.3. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c5811d13-0c5d-4a10-86a1-6318cc2e7663 should be monitored for patch version confirmation. If an immediate update is not possible, a compensating control is to block unauthenticated POST requests to wp-admin/admin-ajax.php with the parameter action=wpfs_update_failed_payment_status at the WAF or reverse proxy layer; this blocks the attack vector without disrupting authenticated site functionality, though it may interfere with legitimate anonymous AJAX actions if the same endpoint path is shared. WordPress sites using a Web Application Firewall such as Wordfence (which has a rule for this vulnerability) can leverage virtual patching as a short-term measure.