# Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.7 - Unauthenticated Insecure Direct Object Reference via Donation Form PaymentIntent ID

- **ID:** WPSEC-2026-1701
- **Plugin:** Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions (`wp-full-stripe-free`), https://wordpress.org/plugins/wp-full-stripe-free/
- **Affected versions:** all versions before 8.5.8
- **Fixed in:** 8.5.8 (Update to 8.5.8 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-full-stripe-free
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1701/

## Description

The Stripe Payment Forms by WP Full Pay plugin for WordPress is vulnerable to Insecure Direct Object Reference via the PaymentIntent ID submitted to the one-time donation charge AJAX actions (wp_full_stripe_onetime_donation_charge and wp_full_stripe_inline_donation_charge) in all versions up to, and including, 8.5.7, due to the plugin retrieving the Stripe PaymentIntent by a user-supplied ID without checking its client secret or that it was created for the submitted donation form. This makes it possible for unauthenticated attackers to make the plugin process an unrelated PaymentIntent as a donation: the plugin rewrites that PaymentIntent's description, metadata, customer and receipt email in Stripe, and if the payment succeeded and was not already recorded as a donation, it records a donation for it on the attacker's chosen form, fires the after-donation actions and webhooks, and sends the plugin's donation receipt (including any invoice link) to an email address the attacker supplies.

## References

- https://wpsec.com/vuln/WPSEC-2026-1701/
- https://plugins.svn.wordpress.org/wp-full-stripe-free/tags/8.5.8/
- https://wordpress.org/plugins/wp-full-stripe-free/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1701/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.