# Leaky Paywall <= 5.3.0 - Unauthenticated Insecure Direct Object Reference to Stripe Customer Payment Method and Subscription Modification via leaky_paywall_create_stripe_checkout_subscription

- **ID:** WPSEC-2026-1865
- **Plugin:** Leaky Paywall (`leaky-paywall`), https://wordpress.org/plugins/leaky-paywall/
- **Affected versions:** all versions before 5.3.1
- **Fixed in:** 5.3.1 (Update to 5.3.1 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/leaky-paywall
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1865/

## Description

The Leaky Paywall plugin for WordPress is vulnerable to Insecure Direct Object Reference via the leaky_paywall_create_stripe_checkout_subscription AJAX action in all versions up to, and including, 5.3.0, due to the handler accepting arbitrary 'customerId', 'paymentMethodId' and 'planId' values from logged-out visitors, protected only by a registration nonce shown on the public registration form, without checking that the Stripe customer belongs to the requester. This makes it possible for unauthenticated attackers who know another customer's Stripe customer ID to attach a payment method to that customer, make it the customer's default payment method, and create subscriptions on it or switch its existing subscription to another Stripe price.

## References

- https://wpsec.com/vuln/WPSEC-2026-1865/
- https://plugins.svn.wordpress.org/leaky-paywall/tags/5.3.1/
- https://wordpress.org/plugins/leaky-paywall/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1865/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.