What the vulnerability does
01Description
The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.
Explanation of Vulnerability in Simple Terms
02Summary
WPFormify – Stripe Payments with Form and Checkout versions 1.1.1 and earlier lack proper authorization checks. An attacker can modify form data or payment details without authentication, potentially altering transaction amounts or redirecting payments. The vulnerability requires no user interaction and is remotely exploitable over the network.
What an attacker can do
03Attacker Capabilities
Modify form submissions or payment details without logging in, potentially changing transaction amounts or payment recipients.
Potential impact on your site
04Site Impact
Attackers can alter customer payments, form submissions, or checkout data, leading to financial loss or data integrity issues.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 5, 2026
CVE published
August 5, 2026
Record updated
