Executive brief
The Stripe Payment Forms by WP Full Pay WordPress plugin allows attackers with a valid customer portal session to cancel, reactivate, or modify subscriptions belonging to other customers. This happens because the plugin fails to verify that a subscription belongs to the customer making the request. An attacker who knows another customer's Stripe subscription ID can abuse this to disrupt rival businesses' recurring payments or revenue streams.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the subscription-management endpoint of the customer portal. The plugin accepts subscription IDs in API requests but does not verify that the requesting user (identified via the WPFS_CARD_UPDATE_SESSION_ID session cookie) owns the subscription before executing cancel, reactivate, or plan-update actions. Attack preconditions include the attacker having a valid confirmed customer-portal session (obtained by email verification), knowledge of the victim's Stripe subscription ID, and the subscription-management feature being enabled. The endpoint is network-accessible and requires only low privilege (a confirmed session); no further authentication is needed per-request. An attacker can directly manipulate other customers' subscriptions at the Stripe API level. The vulnerability is patched in version 8.5.1.
Affected products
- WP Full Pay Stripe Payment Forms before 8.5.1
Timeline
- 2026-08-24: disclosed
- 2026-08-25: patched: Fixed in version 8.5.1