Is CVE-2026-12432 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12432 being exploited in the wild.

How severe is CVE-2026-12432?

Medium severity, with a CVSS score of 5.3, published 27 June 2026.

Which products and versions are affected?

Themeisle WP Full Pay up to, and including, 8.4.3.

Is there a fix for CVE-2026-12432?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12432 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12432?

Check whether you run Themeisle WP Full Pay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12432: Themeisle WP Full Stripe Free missing authorization in payment status update

CVE-2026-12432 · Severity: medium · CVSS 5.3 · Published 2026-06-27

The WP Full Stripe Free plugin for WordPress, which allows websites to accept credit card payments and subscriptions, contains a security flaw in how it handles payment status updates. An unauthorized person can exploit this to change the status of successful payments to 'failed' in the website's database. This could lead to administrative confusion, service disruptions for customers who have already paid, and corrupted financial records.

Vendors: Themeisle.

Quick answers

Is CVE-2026-12432 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12432 being exploited in the wild.
How severe is CVE-2026-12432?: Medium severity, with a CVSS score of 5.3, published 27 June 2026.
Which products and versions are affected?: Themeisle WP Full Pay up to, and including, 8.4.3.
Is there a fix for CVE-2026-12432?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12432 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12432?: Check whether you run Themeisle WP Full Pay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the wpfs_update_failed_payment_status AJAX action, which is registered via both wp_ajax_ and wp_ajax_nopriv_ hooks. The underlying update_failed_payment_status() function fails to implement capability checks, nonce verification, or authentication checks before executing $this->db->updatePaymentByEventId() with user-supplied POST parameters. An unauthenticated attacker who obtains a valid Stripe Payment Intent ID (which is typically exposed to the browser during the checkout process) can send a crafted request to modify database records. This allows the attacker to overwrite payment status, failure codes, and messages for existing transactions. A patch has been released in subsequent versions.

Affected products

Themeisle WP Full Stripe Free (Stripe Payment Forms by WP Full Pay) up to, and including, 8.4.3

Timeline

2026-06-27: disclosed
2026-06-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.