Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.7 - Unauthenticated Insecure Direct Object Reference via Donation Form PaymentIntent ID
- ID
- WPSEC-2026-1701
- Plugin
- Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions (wp-full-stripe-free)
- Affected
- all versions before 8.5.8
- Remediation
- Update to 8.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions on WPSec AttackSurface
- Fix released
- Published
Description
The Stripe Payment Forms by WP Full Pay plugin for WordPress is vulnerable to Insecure Direct Object Reference via the PaymentIntent ID submitted to the one-time donation charge AJAX actions (wp_full_stripe_onetime_donation_charge and wp_full_stripe_inline_donation_charge) in all versions up to, and including, 8.5.7, due to the plugin retrieving the Stripe PaymentIntent by a user-supplied ID without checking its client secret or that it was created for the submitted donation form. This makes it possible for unauthenticated attackers to make the plugin process an unrelated PaymentIntent as a donation: the plugin rewrites that PaymentIntent's description, metadata, customer and receipt email in Stripe, and if the payment succeeded and was not already recorded as a donation, it records a donation for it on the attacker's chosen form, fires the after-donation actions and webhooks, and sends the plugin's donation receipt (including any invoice link) to an email address the attacker supplies.
References
- https://wpsec.com/vuln/WPSEC-2026-1701/
- https://plugins.svn.wordpress.org/wp-full-stripe-free/tags/8.5.8/
- https://wordpress.org/plugins/wp-full-stripe-free/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS