PatchSiren cyber security CVE debrief
CVE-2026-12432 themeisle CVE debrief
The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site to manipulate payment records in the site's database. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check. As a result, attackers can mark previously successful payments as failed and overwrite failure codes and messages with attacker-supplied values.
- Vendor
- themeisle
- Product
- Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-27
- Original CVE updated
- 2026-06-29
- Advisory published
- 2026-06-27
- Advisory updated
- 2026-06-29
Who should care
Administrators of WordPress sites using the WP Full Stripe Free plugin, especially those processing payments through Stripe, should be aware of this vulnerability. Obtaining a valid Stripe Payment Intent ID is a prerequisite for exploitation, which may be accessible through normal Stripe.js checkout flows. Site owners should prioritize updating to a patched version of the plugin.
Technical summary
The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization due to a lack of proper checks in the wpfs_update_failed_payment_status AJAX action. This action is registered via both wp_ajax_ and wp_ajax_nopriv_ hooks, allowing unauthenticated access. The update_failed_payment_status() function does not perform capability checks, nonce verification, or logged-in checks before updating payment records. Attackers can exploit this by manipulating POST parameters to alter payment statuses and details in the site's database, provided they have a valid Stripe Payment Intent ID for the target site.
Defensive priority
High priority should be given to updating the WP Full Stripe Free plugin to a version that addresses this vulnerability. Site administrators should also review their Stripe payment intent IDs for exposure and consider implementing additional monitoring for suspicious payment record changes.
Recommended defensive actions
- Update WP Full Stripe Free plugin to the latest version.
- Review Stripe payment intent IDs for exposure.
- Implement monitoring for suspicious payment record changes.
- Consider restricting access to sensitive payment information.
- Regularly review and update plugins and themes.
Evidence notes
The CVE-2026-12432 record and associated details were obtained from the National Vulnerability Database (NVD) and CVE.org. The vulnerability was reported by [email protected]. The WP Full Stripe Free plugin's code and version details were examined through the WordPress plugin repository.
Official resources
This article is AI-assisted and based on the supplied source corpus.