HomeWordPress vulnerabilitiesStripe Payment Forms by WP Full Pay
Stripe Payment Forms by WP Full Pay vulnerabilities
Stripe Payment Forms by WP Full Pay has 7 known vulnerabilities in this database. The most recent published record is dated 1 Oct 2026.
- Known vulnerabilities
- 7
- Active installs
- 8,000+
- Latest version
- 8.5.7
- Last updated
- 30 Sep 2026
- Most recent
- 1 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-62073 | High 7.5 | Up to 8.5.6 | Fixed in a later version (latest 8.5.7) | 6 d ago |
| Broken access control CVE-2026-80311 | Medium 4.3 | Before 8.5.5 | Fixed in 8.5.5 | 29 Aug 2026 |
| Sensitive data exposure CVE-2026-77758 | Medium 5.3 | Before 8.5.1 | Fixed in 8.5.1 | 26 Aug 2026 |
| Broken access control CVE-2026-77789 | Medium 4.3 | Before 8.5.1 | Fixed in 8.5.1 | 26 Aug 2026 |
| Broken access control CVE-2026-16734 | High 7.5 | Before 8.5.2 | Fixed in 8.5.2 | 6 Aug 2026 |
| Broken access control CVE-2026-12432 | Medium 5.3 | Up to 8.4.3 | Fixed in a later version (latest 8.5.7) | 27 Jun 2026 |
| SQL injection CVE-2025-9322 | High 7.5 | Up to 8.3.1 | Fixed in a later version (latest 8.5.7) | 25 Oct 2025 |
Read the published descriptions
- CVE-2026-62073, 1 Oct 2026
- Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. CVE record
- CVE-2026-80311, 29 Aug 2026
- The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers. Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5. CVE record
- CVE-2026-77758, 26 Aug 2026
- The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information. CVE record
- CVE-2026-77789, 26 Aug 2026
- The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers. CVE record
- CVE-2026-16734, 6 Aug 2026
- The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor - using a nonce that is embedded in every public page containing a payment form - to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation. CVE record
- CVE-2026-12432, 27 Jun 2026
- The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this->db->updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js checkout flows) to manipulate payment records in the site's database, marking previously successful payments as failed and overwriting failure codes and messages with attacker-supplied values. CVE record
- CVE-2025-9322, 25 Oct 2025
- The Stripe Payment Forms by WP Full Pay - Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
What to do if you run Stripe Payment Forms by WP Full Pay
If you run Stripe Payment Forms by WP Full Pay, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Stripe Payment Forms by WP Full Pay vulnerabilities
Free. We email you when a new vulnerability is published for Stripe Payment Forms by WP Full Pay, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.