CVE-2026-62073
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WP Full Stripe Free plugin in versions up to 8.5.6 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing access controls allow unauthorized access to functions or data.
Risk Assessment
An unauthenticated attacker may access protected functions or data in the WordPress site, potentially leading to payment configuration changes or data leakage.
Recommendation
Update the WP Full Stripe Free plugin to a version newer than 8.5.6. If updating is not possible, consider disabling the plugin.
Other vulnerabilities in WP Full Stripe Free
See all- CVE-2026-61960High
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
- CVE-2026-12432Medium
The WP Full Stripe Free plugin for WordPress up to version 8.4.3 lacks authorization in the wpfs_update_failed_payment_status AJAX action. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate payment records in the database, marking successful payments as failed and overwriting error codes.
- CVE-2026-42378Medium
There is a broken authentication issue in WP Full Stripe Free versions up to 8.4.1, which may lead to unauthorized access to user accounts.
Original NVD description (English source)
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS