WP Full Pay EUVD-2026-66289

Exploitation requires the attacker to hold a valid, confirmed customer portal session on the targeted WordPress merchant site - meaning the attacker must be a registered customer (CVSS PR:L confirmed). The customer portal feature must be active and accessible, which is its default operating mode for merchants using the plugin. The attacker must also know or enumerate at least one valid subscription ID belonging to another customer; Stripe subscription IDs follow a predictable 'sub_' prefix format, which may reduce enumeration difficulty. Exploitation is limited to integrity impact only: canceling, reactivating, or modifying subscriptions - there is no evidence of confidentiality exposure (no data read) or availability impact beyond subscription state changes. Guest or unauthenticated visitors cannot exploit this vulnerability.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3 (Medium), appropriately reflecting that exploitation requires a low-privilege authenticated session and produces only integrity impact. The EPSS score of 0.16% at the 5th percentile signals that automated or widespread exploitation is unlikely in the near term, consistent with the need for a valid customer account. However, a publicly available PoC lowers the skill barrier, and the vulnerability is not in CISA KEV at time of analysis. The real-world business risk exceeds the raw CVSS score for merchants: a malicious competitor or disgruntled customer could silently cancel other customers' subscriptions, causing subscription revenue loss and customer-facing service disruption with no confidentiality impact to alert defenders. Attack complexity is genuinely low once the attacker holds a portal session, making this a priority patch for any WordPress merchant using this plugin.

An attacker registers or already holds a legitimate customer account on a WordPress-hosted merchant site using WP Full Pay, obtaining a valid customer portal session. By intercepting or crafting portal requests and substituting other customers' Stripe subscription IDs (obtained via enumeration or prior reconnaissance), the attacker submits cancellation or modification actions that the plugin processes without ownership verification. A publicly available PoC demonstrates this technique, requiring only a valid session cookie and knowledge of a target subscription ID.