Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-77758 EUVD-2026-66288GHSA-7q4v-225q-qmcp

Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session

Published Aug 26, 2026 · Updated Aug 26, 2026 · Assigned by WPScan

Category: Web / CMS

Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.

Affected products

VendorProductAffectedFixed
— Stripe Payment Forms by WP Full Pay < 8.5.1 8.5.1

References