CVE-2026-6627 saadiqbal CVE debrief

Who should care

Administrators and owners of WordPress sites using the WPFormify – Stripe Payments with Form and Checkout plugin, as well as security teams responsible for monitoring and protecting against potential exploitation of this vulnerability.

Technical summary

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions. These functions are hooked to `admin_init`, which fires on `admin-post.php`, accessible without authentication. This allows unauthenticated attackers to overwrite Stripe API credentials with attacker-controlled values or disconnect the Stripe integration entirely. Administrators and owners of WordPress sites using this plugin should verify their version and apply patches or updates. Implementing additional security measures such as Web Application Firewall (WAF) rules can help detect and prevent exploitation attempts. Evidence from the NVD and Wordfence indicates a high-severity vulnerability in the WPFormify plugin, allowing unauthorized modification or deletion of Stripe payment credentials. Limited information is available about affected scope and vendor remediation efforts. The CVSS score of 8.2 indicates high severity, and the potential for significant financial impact through unauthorized modification of Stripe payment credentials necessitates prompt action. Verify the plugin version, monitor Stripe payment credentials for unauthorized changes, and consider compensating controls for exposed systems while remediation is scheduled and verified. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This vulnerability highlights the importance of robust security practices, including regular updates, monitoring, and compensating controls, to mitigate potential impacts. Ensure that security teams are aware of this issue

Defensive priority

High priority due to high CVSS score of 8.2 and potential for significant financial impact through unauthorized modification of Stripe payment credentials.

Recommended defensive actions

• Inventory and verify the WPFormify – Stripe Payments with Form and Checkout plugin version.
• Apply available patches or updates to the WPFormify plugin.
• Monitor Stripe payment credentials for unauthorized changes.
• Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence from the NVD and Wordfence indicates a high-severity vulnerability in the WPFormify plugin. The vulnerability allows unauthenticated attackers to modify or delete Stripe payment credentials. Limited information is available about affected scope and vendor remediation efforts.

Official resources