Stripe Payment Forms By Wp Full Pay
Monthly
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. A publicly available proof-of-concept exists; exploitation probability is low per EPSS (0.16%, 5th percentile), but the business impact on affected merchants' subscription revenue could be significant despite the moderate CVSS score.
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and billing data to unauthenticated network attackers due to a missing session-confirmation check in the customer portal workflow. The plugin returns sensitive financial records before verifying that a portal session has completed its confirmation step, enabling any unauthenticated user to read billing information belonging to a different customer. A publicly available exploit exists per WPScan intelligence, though EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation despite the low-barrier attack path.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. A publicly available proof-of-concept exists; exploitation probability is low per EPSS (0.16%, 5th percentile), but the business impact on affected merchants' subscription revenue could be significant despite the moderate CVSS score.
Stripe Payment Forms by WP Full Pay plugin for WordPress (all versions before 8.5.1) exposes customer subscription and billing data to unauthenticated network attackers due to a missing session-confirmation check in the customer portal workflow. The plugin returns sensitive financial records before verifying that a portal session has completed its confirmation step, enabling any unauthenticated user to read billing information belonging to a different customer. A publicly available exploit exists per WPScan intelligence, though EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation despite the low-barrier attack path.