CVE-2026-77758

Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.

Affected

Stripe Payment Forms by WP Full Pay

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 27th percentile

Published

2026-08-26

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2d4fc012-9f80-43cc-b68d-96842700fe2f/

References

• CVE Record
• NVD entry