{
 "id": "WPSEC-2026-2662",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2662/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2662/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2662/index.md",
 "title": "Stripe Payment Forms by WP Simple Pay <= 4.17.5 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Duplication",
 "description": "The Stripe Payment Forms by WP Simple Pay plugin for WordPress is vulnerable to unauthorized post duplication via the payment form duplicate action in all versions up to, and including, 4.17.5, due to a missing capability check and missing post type validation in the duplicate() function, which runs on admin_init and is protected only by a generic nonce that the legacy 'duplicate' redirect issues to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create copies of arbitrary posts of any post type, including their post meta and post status, owned by the attacker. The same legacy redirect also lets an attacker trigger a duplication through a link clicked by a logged-in administrator.",
 "plugin": {
  "slug": "stripe",
  "name": "Stripe Payment Forms by WP Simple Pay",
  "full_name": "Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe",
  "wordpress_org": "https://wordpress.org/plugins/stripe/",
  "advisories_url": "https://wpsec.com/vuln/plugin/stripe/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/stripe"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.17.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.17.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.17.6",
 "remediation": "Update to 4.17.6 or later.",
 "fix_released": "2026-11-05T13:26:48+00:00",
 "published": "2026-11-06T13:52:33+00:00",
 "updated": "2026-11-06T12:03:06.333624+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2662/",
  "https://plugins.svn.wordpress.org/stripe/tags/4.17.6/",
  "https://wordpress.org/plugins/stripe/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/stripe",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}