CVE-2026-16734 WP Full Pay CVE debrief

Who should care

Administrators and users of WordPress sites with Stripe Payment Forms by WP Full Pay plugin installed, especially those processing payments through Stripe, should review and update their installations to prevent potential financial loss through payment manipulation. They should also restrict access to payment form AJAX actions and implement additional authentication and authorization checks for payment processing. Furthermore, they should monitor for suspicious payment intent updates and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should prioritize this vulnerability due to its high CVSS score of 7.5 and potential for financial loss through payment manipulation. They should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Additionally, they should track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators of affected systems should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and check relevant monitoring, detection, and logs for exposed assets that need extra review. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management teams should review compensating controls for exposed systems while remediation is scheduled and verified and implement additional authentication and authorization checks for payment processing. They should also review and restrict access to payment form AJAX actions and monitor for suspicious payment intent updates. Asset inventory managers should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Those responsible for change management should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. They

Technical summary

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify caller ownership of Stripe payment intents in two unauthenticated payment-form AJAX actions. This allows unauthenticated visitors to change payment intent amounts using a nonce embedded in public pages with payment forms. The plugin updates payment intents server-side through the Stripe API using the store's secret key. An ownership check added in version 8.5.0 was only applied to one payment-intent handler, leaving pricing recalculation and payment-intent update actions unprotected.

Defensive priority

High priority due to high CVSS score of 7.5 and potential for financial loss through payment manipulation.

Recommended defensive actions

• Update Stripe Payment Forms by WP Full Pay WordPress plugin to version 8.5.2 or later
• Review and restrict access to payment form AJAX actions
• Monitor for suspicious payment intent updates
• Implement additional authentication and authorization checks for payment processing
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from WPScan and NVD indicates a vulnerability in Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2. Limited details are available on exploitability and affected versions beyond the plugin version. The vulnerability allows unauthenticated visitors to change payment intent amounts using a nonce embedded in public pages with payment forms. Defenders should verify affected plugin versions, review payment form configurations, and monitor for suspicious payment intent updates.

Official resources