CVE-2026-62073 in WP Full Stripe Free Plugin
Summary
by MITRE • 10/01/2026
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an unbroken access control issue within WP Full Stripe Free versions prior to or equal to 8.5.6 represents a critical failure in the application's authentication and authorization mechanisms. This flaw allows attackers who have not authenticated themselves into the WordPress environment to perform actions that are strictly reserved for authorized administrators. The core of this vulnerability lies in the improper implementation of access control checks on specific administrative endpoints exposed by the plugin. In secure software design, any function or endpoint that modifies system state, such as changing payment gateway settings, creating subscription plans, or accessing sensitive customer data, must verify that the requesting user possesses the necessary privileges before executing the operation. The absence of these verification steps creates a direct pathway for exploitation without requiring valid credentials.
From a technical perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, and specifically maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this case, the attacker does not need valid accounts at all due to the lack of authentication checks. The flaw typically manifests when an API endpoint or AJAX handler within the plugin fails to call WordPress functions such as current_user_can with appropriate capability parameters like manage_options or edit_posts. Consequently, any user on the internet can send crafted HTTP requests directly to these endpoints. This bypasses standard security layers including firewalls and intrusion detection systems that might otherwise block unauthorized access attempts because the traffic appears legitimate from a protocol standpoint but lacks proper identity verification at the application logic level.
The operational impact of this vulnerability is severe, potentially leading to complete compromise of the WordPress installation hosting the plugin. An attacker can manipulate payment processing configurations by altering Stripe API keys or webhook URLs, which could result in financial fraud where payments are diverted to malicious accounts rather than the legitimate business owner. Furthermore, the ability to modify subscription plans and customer data exposes sensitive personally identifiable information (PII) including names, email addresses, billing details, and transaction histories. This exposure violates privacy regulations such as GDPR or CCPA depending on the jurisdiction of the affected entities. Additionally, if the plugin allows for arbitrary file uploads or code execution through its settings interface, which is common in poorly secured plugins, an attacker could achieve remote code execution (RCE), gaining full control over the underlying server infrastructure and potentially pivoting to attack other systems within the network.
Mitigation strategies must prioritize immediate remediation by updating WP Full Stripe Free to version 8.5.7 or later where these access controls have been properly implemented. Until an update is applied, administrators should consider disabling the plugin entirely if it is not actively required for business operations. Implementing a Web Application Firewall (WAF) with rules specifically targeting suspicious POST requests to known vulnerable endpoints can provide temporary protection by blocking unauthorized API calls at the network perimeter. It is also crucial to enforce strict principle of least privilege across all user roles within WordPress, ensuring that no non-administrator users have elevated capabilities that could be exploited if similar flaws exist elsewhere in the ecosystem. Regular security audits and penetration testing focused on broken access control patterns are recommended to identify and rectify such vulnerabilities before they can be leveraged by malicious actors for financial gain or data exfiltration.