CVSS
7.5
CVSS v3.1
EPSS
0.2%
Exploit Prediction Score
Published
August 6, 2026
Exploitability
EPSS probability 0.2%
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).