What is the CVSS score of EUVD-2026-53725?

EUVD-2026-53725 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WP Full Pay are affected by EUVD-2026-53725?

Stripe Payment Forms by WP Full Pay (WordPress plugin) versions before 8.5.2 contain an unauthenticated payment manipulation vulnerability allowing attackers to zero-out or arbitrarily reduce…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-53725?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53725. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-53725?

Within 24 hours: identify all WordPress instances running Stripe Payment Forms by WP Full Pay by checking the wp-content/plugins directory or admin dashboard; if version 8.5.1 or earlier is confirmed, disable the plugin or restrict payment form access pending update. Within 7 days: obtain vendor-released patch version 8.5.2 or later, deploy to a staging environment, and validate that payment workflows and any custom extensions function correctly after the upgrade. Within 30 days: deploy the patched version (8.5.2+) to all production WordPress instances, verify via transaction testing that payment amounts cannot be manipulated before checkout, and review transaction logs for signs of prior exploitation attempts.

WP Full Pay EUVD-2026-53725

| CVE-2026-16734 HIGH

Missing Authorization (CWE-862)

2026-08-06 WPScan

GHSA-8673-2q96-2vmf

WordPress Authentication Bypass Stripe Payment Forms By Wp Full Pay

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Nonce is publicly embedded on every payment form page requiring no credentials; payment amount manipulation via Stripe API constitutes high integrity impact with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:22 vuln.today

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor - using a nonce that is embedded in every public page containing a payment form - to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

AnalysisAI

Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Load public page containing payment form

Delivery

Extract embedded WordPress nonce from HTML

Exploit

Initiate legitimate checkout to obtain Stripe payment intent ID

Execution

Send crafted AJAX POST to unprotected recalculation endpoint with manipulated amount

Persist

Plugin updates Stripe payment intent server-side via store's secret key

Impact

Complete checkout at attacker-chosen price

Access

Load public page containing payment form

Delivery

Extract embedded WordPress nonce from HTML

Exploit

Initiate legitimate checkout to obtain Stripe payment intent ID

Execution

Send crafted AJAX POST to unprotected recalculation endpoint with manipulated amount

Persist

Plugin updates Stripe payment intent server-side via store's secret key

Impact

Complete checkout at attacker-chosen price

Vulnerability AssessmentAI

Exploitation	The target WordPress site must have the Stripe Payment Forms by WP Full Pay plugin installed and active at a version below 8.5.2, and at least one payment form must be embedded on a publicly accessible page. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately reflects a network-exploitable, zero-complexity, unauthenticated attack with high integrity impact - the ability to manipulate payment amounts is a direct financial harm. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker visits any public page of the target WordPress store that contains a WP Full Pay payment form, extracts the WordPress nonce value embedded in the page HTML, and then submits a crafted unauthenticated HTTP POST request to the site's wp-admin/admin-ajax.php endpoint targeting the unprotected pricing-recalculation or payment-intent-update AJAX action, specifying an existing Stripe payment intent ID (obtainable by initiating a legitimate checkout flow) along with a manipulated price. A publicly available proof-of-concept documents the exact request structure, making this trivially scriptable.
Remediation	Update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.2 or later immediately; this is the only confirmed complete fix per the vendor and WPScan (https://wpscan.com/vulnerability/5fcb5b11-3ebd-4821-aa6f-c6be70bac395/). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: identify all WordPress instances running Stripe Payment Forms by WP Full Pay by checking the wp-content/plugins directory or admin dashboard; if version 8.5.1 or earlier is confirmed, disable the plugin or restrict payment form access pending update. …

Threat intelligence, references, and detailed analysis are available after sign-in.