Stripe Payment Forms By Wp Full Pay
Monthly
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.