Junglewise Threat Intelligence

CVE-2026-12432: Themeisle WP Full Stripe Free missing authorization in payment status update

CVE-2026-12432 · Severity: medium · CVSS 5.3 · Published 2026-06-27

Vendors: Themeisle.

Executive brief

The WP Full Stripe Free plugin for WordPress, which allows websites to accept credit card payments and subscriptions, contains a security flaw in how it handles payment status updates. An unauthorized person can exploit this to change the status of successful payments to 'failed' in the website's database. This could lead to administrative confusion, service disruptions for customers who have already paid, and corrupted financial records.

Technical details

The vulnerability exists in the wpfs_update_failed_payment_status AJAX action, which is registered via both wp_ajax_ and wp_ajax_nopriv_ hooks. The underlying update_failed_payment_status() function fails to implement capability checks, nonce verification, or authentication checks before executing $this->db->updatePaymentByEventId() with user-supplied POST parameters. An unauthenticated attacker who obtains a valid Stripe Payment Intent ID (which is typically exposed to the browser during the checkout process) can send a crafted request to modify database records. This allows the attacker to overwrite payment status, failure codes, and messages for existing transactions. A patch has been released in subsequent versions.

Affected products

  • Themeisle WP Full Stripe Free (Stripe Payment Forms by WP Full Pay) up to, and including, 8.4.3

Timeline

  • 2026-06-27: disclosed
  • 2026-06-27: advisory

References