What is the CVSS score of EUVD-2026-90853?

EUVD-2026-90853 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-90853?

Within 24 hours, inventory all WordPress installations running WP Full Stripe Free 8.5.6 or earlier and determine which are publicly reachable and actively processing Stripe payments; for any internet-facing instance that is not business-critical, deactivate and remove the plugin until a fix ships, and for those that must remain live, place them behind a WAF or reverse proxy with rules blocking unauthenticated POST/state-changing requests to the plugin's endpoints and restrict wp-admin and REST paths to trusted IPs where feasible. Within 7 days, confirm with the vendor whether a fixed release beyond 8.5.6 is imminent, and where it is not, decide formally between continued WAF/virtual patching and permanent removal; audit Stripe account settings, webhook URLs, and plugin-stored configuration for unauthorized changes, and rotate Stripe API keys and WordPress administrative credentials on affected sites as a precaution. Within 30 days, migrate any remaining sites to an actively maintained alternative payment plugin or to a version the vendor confirms is patched, apply vendor-released updates as soon as they are published, and add monitoring and alerting for unexpected configuration changes on payment-handling plugins so similar authorization gaps are detected quickly in future.

WP Full Stripe Free EUVD-2026-90853

| CVE-2026-62073 HIGH

Missing Authorization (CWE-862)

2026-10-01 Patchstack

GHSA-f2pj-m3mv-cr8g

WordPress Wordpress Plugin Wp Full Stripe Free Themeisle

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running vulnerable plugin
Delivery

Locate unprotected plugin endpoint
Exploit

Send crafted unauthenticated request
Execution

Bypass missing authorization check
Impact

Perform unauthorized state change (integrity impact)

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires only that the target WordPress site has WP Full Stripe Free version 8.5.6 or earlier installed and active, with the vulnerable plugin endpoint network-reachable - matching AV:N/AC:L/PR:N/UI:N, i.e. no authentication, no special privileges, and no user interaction. The description does not name a specific non-default configuration toggle, so exploitation appears viable against default installations of the affected versions. The primary limiting factors are the plugin's niche deployment footprint and the integrity-only impact (C:N/A:N): the flaw enables unauthorized state changes but not, per the vector, data disclosure or denial of service. The exact affected endpoint/action is not specified in the available data and should be confirmed from the Patchstack advisory.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5 HIGH) describes a network-reachable, low-complexity, fully unauthenticated flaw with no user interaction and high integrity impact but zero confidentiality or availability impact - consistent with CWE-862 Missing Authorization where an unauthenticated actor can invoke a privileged state-changing action. This is the most dangerous class of Patchstack broken-access-control finding because PR:N removes the usual 'authenticated contributor/subscriber' gate most WordPress plugin BAC bugs carry. However, several real-risk-dampening signals are ABSENT from the input: no EPSS probability, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or automated exploitation. The I:H with C:N/A:N rating is unusually strong for an unauth BAC bug (most score I:L); this should be verified against the Patchstack advisory, since it implies a single unauthenticated request can meaningfully alter plugin/payment state. Net: a genuinely attention-worthy unauthenticated vulnerability by vector, but with no exploitation-maturity evidence it is a patch-promptly rather than drop-everything item, and its real-world blast radius is bounded by the plugin's modest deployment footprint.
Exploit ScenarioDerived	An unauthenticated attacker identifies a WordPress site running WP Full Stripe Free <= 8.5.6 and sends a crafted request directly to a plugin endpoint (AJAX action or REST route) that fails to verify the caller's capability or nonce. Because no authentication, privileges, or user interaction are required (PR:N/UI:N/AC:L), the request succeeds and performs an unauthorized state-changing operation affecting integrity. No public proof-of-concept is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Missing authorization in the WP Full Stripe Free WordPress plugin (versions 8.5.6 and earlier) lets remote attackers perform privileged state-changing actions without logging in, because the plugin fails to verify that a request comes from an authorized user. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 HIGH), meaning the flaw is network-reachable and exploitable without authentication, privileges, or user interaction, and its impact is limited to integrity - an attacker can alter data or configuration but, per the vector, cannot read data or cause denial of service. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is tempered mainly by the plugin's niche deployment footprint and the integrity-only impact.

RemediationAI

No fixed version is identified in the available intelligence; the advisory at https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-5-6-broken-access-control-vulnerability?_s_id=cve should be checked for a patched release, and administrators should upgrade WP Full Stripe Free past 8.5.6 as soon as a corrected version is published - patch status is not confirmed from the provided data, so do not assume 8.5.6 or any later number is safe. Until a fix is available, the most reliable compensating control is to deactivate and remove the plugin if Stripe payment/checkout functionality is not actively required; the trade-off is complete loss of the plugin's payment forms and subscription handling. If the plugin must remain active, restrict access to its handlers with a WAF or reverse-proxy rule that blocks unauthenticated requests to the plugin's REST routes (/wp-json/... containing wp-full-stripe-free) and to the specific admin-ajax.php action tied to the vulnerable function, once that action name is confirmed from the advisory - this reduces exposure but may break legitimate front-end payment flows that rely on unauthenticated callers, so rules must be tested against real checkout traffic. Additionally, limit write access to the site (tighten WordPress roles, monitor for unexpected option or post modifications), log and alert on state-change requests originating from unauthenticated sessions, and apply virtual patching via the Patchstack or an equivalent WAF integration. Since the impact is integrity-only, prioritize detection of unauthorized configuration/data changes over data-leak monitoring, and verify that no attacker-created options, webhooks, or payment records persist after an attempted exploitation.

Affected VersionsENISA

WP Full Stripe Free n/a ≤8.5.6

Affected Packages

euvd wp_full_stripe_free no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is a third-party WordPress plugin, WP Full Stripe Free, distributed by Themeisle and identified in the CPE data as cpe:2.3:a:themeisle:wp_full_stripe_free. The root cause is CWE-862 (Missing Authorization): the plugin exposes a functionality entry point - typically a WordPress AJAX action or REST route - that performs a privileged, state-changing operation but does not run a capability check or nonce/authorization verification before acting. Because WordPress routes requests through shared endpoints such as admin-ajax.php or /wp-json/, such handlers are frequently reachable over the network by unauthenticated visitors unless the plugin explicitly gates them, which is exactly what is missing here. The assessed vector (PR:N, UI:N, S:U) confirms the handler is callable without credentials and does not cross a privilege boundary in a way that would escalate the impact class; the C:N/A:N components indicate the abused action modifies state rather than disclosing stored secrets or degrading availability. The specific vulnerable action/endpoint is not named in the available intelligence and should be confirmed from the Patchstack advisory for precise detection and virtual patching rules.

Know when Wp Full Stripe Free gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 7.5 HIGH

Unauthenticated (PR:N), remote (AV:N), low-complexity (AC:L) missing-authorization flaw with integrity-only impact (I:H, C:N/A:N); I:H retained per vendor rating though I:L is plausible pending advisory detail.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

Executive ViewAI

Why It Matters

A missing authorization flaw in WP Full Stripe Free (versions 8.5.6 and earlier) allows anyone on the internet to change plugin configuration and related payment settings without logging in, meaning an attacker could redirect or alter how a WordPress site processes Stripe transactions. The exposure is limited to data and configuration integrity rather than theft of stored data or service disruption, and the plugin's relatively narrow deployment footprint reduces the number of organizations at risk. Leadership should care because sites relying on this plugin for live payment collection could have their checkout configuration silently altered, with potential financial and customer-trust consequences even without any data breach.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or uninstalling WP Full Stripe Free 8.5.6 and earlier on internet-facing sites, deploying WAF or reverse-proxy rules that block unauthenticated state-changing requests to the plugin's endpoints, restricting wp-admin and REST API access by IP or authentication, applying virtual patching if the hosting or security provider supports it, auditing Stripe configuration, webhooks, and API keys for unauthorized modification, and rotating Stripe and WordPress administrative credentials on affected installations.

Threat Intelligence Overview

EPSS Score

0.2%

Top 86% exploitable

Prevalence

Low

niche WordPress Stripe-payment form plugin, limited install base

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.