{
 "id": "WPSEC-2026-1865",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1865/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1865/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1865/index.md",
 "title": "Leaky Paywall <= 5.3.0 - Unauthenticated Insecure Direct Object Reference to Stripe Customer Payment Method and Subscription Modification via leaky_paywall_create_stripe_checkout_subscription",
 "description": "The Leaky Paywall plugin for WordPress is vulnerable to Insecure Direct Object Reference via the leaky_paywall_create_stripe_checkout_subscription AJAX action in all versions up to, and including, 5.3.0, due to the handler accepting arbitrary 'customerId', 'paymentMethodId' and 'planId' values from logged-out visitors, protected only by a registration nonce shown on the public registration form, without checking that the Stripe customer belongs to the requester. This makes it possible for unauthenticated attackers who know another customer's Stripe customer ID to attach a payment method to that customer, make it the customer's default payment method, and create subscriptions on it or switch its existing subscription to another Stripe price.",
 "plugin": {
  "slug": "leaky-paywall",
  "name": "Leaky Paywall",
  "full_name": "Leaky Paywall",
  "wordpress_org": "https://wordpress.org/plugins/leaky-paywall/",
  "advisories_url": "https://wpsec.com/vuln/plugin/leaky-paywall/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/leaky-paywall"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.1",
 "remediation": "Update to 5.3.1 or later.",
 "fix_released": "2026-10-27T18:38:20+00:00",
 "published": "2026-10-28T18:46:30+00:00",
 "updated": "2026-10-28T09:33:45.772629+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1865/",
  "https://plugins.svn.wordpress.org/leaky-paywall/tags/5.3.1/",
  "https://wordpress.org/plugins/leaky-paywall/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/leaky-paywall",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}