Stripe Payment Forms by WP Full Pay vulnerabilities
3 known CVE vulnerabilities in Stripe Payment Forms by WP Full Pay, translated and rated.
- CVE-2026-80311Low risk· EPSS 3%
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers. Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable.
- CVE-2026-77789Medium
The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it. This allows a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.
- CVE-2026-77758Medium
The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.