PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12432 themeisle CVE debrief

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site to manipulate payment records in the site's database. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check. As a result, attackers can mark previously successful payments as failed and overwrite failure codes and messages with attacker-supplied values.

Vendor
themeisle
Product
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-27
Original CVE updated
2026-06-29
Advisory published
2026-06-27
Advisory updated
2026-06-29

Who should care

Administrators of WordPress sites using the WP Full Stripe Free plugin, especially those processing payments through Stripe, should be aware of this vulnerability. Obtaining a valid Stripe Payment Intent ID is a prerequisite for exploitation, which may be accessible through normal Stripe.js checkout flows. Site owners should prioritize updating to a patched version of the plugin.

Technical summary

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization due to a lack of proper checks in the wpfs_update_failed_payment_status AJAX action. This action is registered via both wp_ajax_ and wp_ajax_nopriv_ hooks, allowing unauthenticated access. The update_failed_payment_status() function does not perform capability checks, nonce verification, or logged-in checks before updating payment records. Attackers can exploit this by manipulating POST parameters to alter payment statuses and details in the site's database, provided they have a valid Stripe Payment Intent ID for the target site.

Defensive priority

High priority should be given to updating the WP Full Stripe Free plugin to a version that addresses this vulnerability. Site administrators should also review their Stripe payment intent IDs for exposure and consider implementing additional monitoring for suspicious payment record changes.

Recommended defensive actions

  • Update WP Full Stripe Free plugin to the latest version.
  • Review Stripe payment intent IDs for exposure.
  • Implement monitoring for suspicious payment record changes.
  • Consider restricting access to sensitive payment information.
  • Regularly review and update plugins and themes.

Evidence notes

The CVE-2026-12432 record and associated details were obtained from the National Vulnerability Database (NVD) and CVE.org. The vulnerability was reported by [email protected]. The WP Full Stripe Free plugin's code and version details were examined through the WordPress plugin repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12432 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12432

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12432 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12432

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.1/includes/wpfs-customer.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.1/includes/wpfs-customer.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.1/includes/wpfs-customer.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.1/includes/wpfs-database.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.3/includes/wpfs-customer.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.3/includes/wpfs-customer.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-full-stripe-free/tags/8.4.3/includes/wpfs-customer.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.