Authorization Flaw in Stripe Payment Forms Plugin by WP Full Pay
CVE-2026-77789

Currently unrated

Key Information:

Vendor

WordPress
Status
Stripe Payment Forms By WP Full Pay
Vendor
CVE Published:
26 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77789?

The Stripe Payment Forms plugin by WP Full Pay for WordPress prior to version 8.5.1 contains an authorization flaw that allows a user with a valid session to manipulate subscriptions that do not belong to them. Specifically, this vulnerability permits unauthorized actions such as canceling, reactivating, or modifying subscriptions owned by other customers due to a lack of verification in the customer-portal session. This oversight poses significant risks to user accounts and subscription integrity.

Affected Version(s)

Stripe Payment Forms by WP Full Pay 0 < 8.5.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77789 - Proof of Concept

References

https://wpscan.com/vulnerability/b467131b-15e1-4d1e-9a6a-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Charles Vosburgh
WPScan
.