CVE-2026-81423

MediumCVSS 4.3

Published: 05/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The Accept Stripe Payments WordPress plugin before version 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.

Risk Assessment

An attacker can exploit the open redirect for phishing, directing users to fake login pages or malicious sites, potentially leading to credential theft.

Recommendation

Update the Accept Stripe Payments plugin to version 2.1.4 or later, which includes the URL validation fix.

Other vulnerabilities in Accept Stripe Payments WordPress plugin

CVE-2026-81424Medium
The Accept Stripe Payments WordPress plugin before version 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.

Original NVD description (English source)

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS