Leaky Paywall <= 5.3.0 - Unauthenticated Insecure Direct Object Reference to Stripe Customer Payment Method and Subscription Modification via leaky_paywall_create_stripe_checkout_subscription
- ID
- WPSEC-2026-1865
- Plugin
- Leaky Paywall (leaky-paywall)
- Affected
- all versions before 5.3.1
- Remediation
- Update to 5.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Leaky Paywall on WPSec AttackSurface
- Fix released
- Published
Description
The Leaky Paywall plugin for WordPress is vulnerable to Insecure Direct Object Reference via the leaky_paywall_create_stripe_checkout_subscription AJAX action in all versions up to, and including, 5.3.0, due to the handler accepting arbitrary 'customerId', 'paymentMethodId' and 'planId' values from logged-out visitors, protected only by a registration nonce shown on the public registration form, without checking that the Stripe customer belongs to the requester. This makes it possible for unauthenticated attackers who know another customer's Stripe customer ID to attach a payment method to that customer, make it the customer's default payment method, and create subscriptions on it or switch its existing subscription to another Stripe price.
References
- https://wpsec.com/vuln/WPSEC-2026-1865/
- https://plugins.svn.wordpress.org/leaky-paywall/tags/5.3.1/
- https://wordpress.org/plugins/leaky-paywall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS