Medium severity4.3NVD Advisory· Published Aug 26, 2026· Updated Aug 26, 2026

CVE-2026-77789

Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Stripe Payment Forms by WP Full Payllm-fuzzy
Range: <8.5.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/b467131b-15e1-4d1e-9a6a-3ee6e8bd3722/nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000