https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:14:13 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12432 <p><strong>Affected:</strong> themeisle Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations &amp; Subscriptions</p> <p>The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this-&gt;db-&gt;updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js checkout flows) to manipulate payment records in the site&#39;s database, marking previously successful payments as failed and overwriting failure codes and messages with attacker-supplied values.</p> <p><strong>Affected:</strong> themeisle Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations &amp; Subscriptions</p> <p>The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this-&gt;db-&gt;updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js checkout flows) to manipulate payment records in the site&#39;s database, marking previously successful payments as failed and overwriting failure codes and messages with attacker-supplied values.</p> https://cve.radiocsirt.org/vuln/cve-2026-12432