CVE-2026-42378
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
There is a broken authentication issue in WP Full Stripe Free versions up to 8.4.1, which may lead to unauthorized access to user accounts.
Risk Assessment
The organization may be exposed to unauthorized user actions, potentially resulting in data loss or privacy breaches.
Recommendation
It is recommended to update the WP Full Stripe Free plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP Full Stripe Free
See all- CVE-2026-61960High
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
- CVE-2026-12432Medium
The WP Full Stripe Free plugin for WordPress up to version 8.4.3 lacks authorization in the wpfs_update_failed_payment_status AJAX action. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate payment records in the database, marking successful payments as failed and overwriting error codes.
Original NVD description (English source)
Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.