Improper Access Control in WP Full Pay Stripe Payment Forms Plugin
CVE-2026-80311
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 August 2026
Badges
What is CVE-2026-80311?
The Stripe Payment Forms plugin by WP Full Pay for WordPress contains a vulnerability that allows an authenticated user to cancel subscriptions that do not belong to them. This oversight occurs due to the lack of proper verification to confirm that a subscription is associated with the requesting user’s session. Although the subscription identifiers are designed to be high-entropy and not easily guessable, an attacker with access to a customer portal session can exploit this flaw to manipulate subscriptions improperly.
Affected Version(s)
Stripe Payment Forms by WP Full Pay 0 < 8.5.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.