Unauthorized Modification Risk in WPFormify Stripe Payments Plugin for WordPress

CVE-2026-6627

What is CVE-2026-6627?

The WPFormify Stripe Payments with Form and Checkout plugin for WordPress is susceptible to vulnerabilities that allow unauthorized modification and deletion of Stripe payment credentials in all versions up to and including 1.1.1. This issue arises from the lack of essential capability checks and nonce verification in critical functions such as wpf_stripe_callback_success() and wpf_stripe_disconnect(). These functions are triggered via the admin_init hook, which can be accessed without proper authentication. As a result, unauthenticated attackers may exploit this vulnerability to overwrite critical Stripe API credentials with malicious data, effectively redirecting payments to unauthorized accounts or entirely severing the integration by deleting essential stored credentials.

References