Stripe Payment Forms by WP Simple Pay <= 4.17.5 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Duplication
- ID
- WPSEC-2026-2662
- Plugin
- Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe (stripe)
- Affected
- all versions before 4.17.6
- Remediation
- Update to 4.17.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- Stripe Payment Forms by WP Simple Pay on WPSec AttackSurface
- Fix released
- Published
Description
The Stripe Payment Forms by WP Simple Pay plugin for WordPress is vulnerable to unauthorized post duplication via the payment form duplicate action in all versions up to, and including, 4.17.5, due to a missing capability check and missing post type validation in the duplicate() function, which runs on admin_init and is protected only by a generic nonce that the legacy 'duplicate' redirect issues to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create copies of arbitrary posts of any post type, including their post meta and post status, owned by the attacker. The same legacy redirect also lets an attacker trigger a duplication through a link clicked by a logged-in administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-2662/
- https://plugins.svn.wordpress.org/stripe/tags/4.17.6/
- https://wordpress.org/plugins/stripe/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS