CVE-2026-77789 in Stripe Payment Forms by WP Full Pay Plugin
Summary
by MITRE • 08/26/2026
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Stripe Payment Forms by WP Full Pay prior to version 8.5.1 represents a critical failure in server-side authorization logic within the WordPress plugin ecosystem. This flaw specifically affects the handling of customer portal sessions, which are designed to allow users to manage their own subscription details securely through an interface provided by Stripe. The core technical deficiency lies in the absence of strict ownership verification when processing actions such as cancellation, reactivation, or modification of subscriptions. When a user initiates a session via the customer portal, the system establishes that the user is authenticated and has access to the portal interface. However, the backend logic fails to cross-reference the specific subscription identifier being acted upon against the set of subscriptions legitimately associated with the authenticated user's account ID. This oversight creates a direct path for Insecure Direct Object Reference (IDOR) attacks, categorized under CWE-639 in the Common Weakness Enumeration standard.
From an operational perspective, this vulnerability allows any attacker who can obtain or forge a valid customer portal session token to manipulate subscription data belonging to other customers. By manipulating the parameters sent during API calls associated with subscription management actions, an adversary can target arbitrary subscription IDs. Since the server does not validate that the requested subscription belongs to the current session's owner, it processes these requests as legitimate administrative commands. This leads to severe confidentiality and integrity violations. Attackers can cancel active subscriptions of other users, causing service disruption for those customers and potential revenue loss for site administrators who rely on recurring payments. Furthermore, attackers may reactivate dormant or expired subscriptions belonging to others, potentially leading to unauthorized charges if payment methods are still valid, thereby exposing victims to financial fraud and eroding trust in the platform's security posture.
The impact extends beyond immediate financial consequences to include significant reputational damage for website owners utilizing this plugin. In e-commerce environments where customer data is highly sensitive, the ability to alter subscription states without proper authorization undermines the fundamental principle of least privilege. It demonstrates a lack of robust access control mechanisms at the application layer, specifically failing to enforce object-level permissions. This type of vulnerability is particularly dangerous because it often bypasses standard authentication checks; while the user is logged in and has a valid session, they are operating outside their authorized scope. Security researchers frequently map such flaws to MITRE ATT&CK techniques related to Privilege Escalation or Account Manipulation, as the attacker effectively gains control over resources that do not belong to them by exploiting trust relationships within the application's state management logic.
Mitigation for this vulnerability requires immediate action from both plugin developers and site administrators. The primary remediation is to upgrade WP Full Pay to version 8.5.1 or later, where the vendor has implemented proper validation checks ensuring that subscription actions are strictly bound to the authenticated user’s account ID. For organizations unable to update immediately due to compatibility constraints with other plugins or custom code modifications, temporary mitigations should focus on restricting access to the customer portal endpoints if possible, although this may impact legitimate user experience. Additionally, implementing Web Application Firewall rules that detect anomalous patterns in subscription API calls could provide a layer of defense against automated exploitation attempts. Developers must also conduct thorough security audits focusing on IDOR vulnerabilities across all endpoints handling sensitive user data, ensuring that every state-changing operation verifies ownership before execution. Regular penetration testing and code reviews are essential to identify similar logical flaws in other parts of the application architecture.