# Stripe Payment Forms by WP Simple Pay <= 4.17.5 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Duplication

- **ID:** WPSEC-2026-2662
- **Plugin:** Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe (`stripe`), https://wordpress.org/plugins/stripe/
- **Affected versions:** all versions before 4.17.6
- **Fixed in:** 4.17.6 (Update to 4.17.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/stripe
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2662/

## Description

The Stripe Payment Forms by WP Simple Pay plugin for WordPress is vulnerable to unauthorized post duplication via the payment form duplicate action in all versions up to, and including, 4.17.5, due to a missing capability check and missing post type validation in the duplicate() function, which runs on admin_init and is protected only by a generic nonce that the legacy 'duplicate' redirect issues to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create copies of arbitrary posts of any post type, including their post meta and post status, owned by the attacker. The same legacy redirect also lets an attacker trigger a duplication through a link clicked by a logged-in administrator.

## References

- https://wpsec.com/vuln/WPSEC-2026-2662/
- https://plugins.svn.wordpress.org/stripe/tags/4.17.6/
- https://wordpress.org/plugins/stripe/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2662/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.