WPFormify – Stripe Payments with Form and Checkout
WPFormify – Stripe Payments with Form and Checkout is a WordPress component with 1 published CVE record in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 8.2.
wpformifyCVE-2026-6627: WPFormify public callbacks permit Stripe credential replacement or deletion
WPFormify through 1.1.1 hooks wpf_stripe_callback_success() and wpf_stripe_disconnect() to admin_init without capability or nonce checks. Because admin-post.php is publicly reachable and fires admin_init, an unauthenticated attacker can invoke the success path with attacker-controlled Stripe credentials or invoke the disconnect path to delete the stored credentials. This can redirect future payments to the attacker's Stripe account or disable the integration. The CNA does not disclose the trigger parameters or option names.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-6627
WPFormify public callbacks permit Stripe credential replacement or deletion
WPFormify through 1.1.1 hooks wpf_stripe_callback_success() and wpf_stripe_disconnect() to admin_init without capability or nonce checks. Because admin-post.php is publicly reachable and fires admin_init, an unauthenticated attacker can invoke the success path with attacker-controlled Stripe credentials or invoke the disconnect path to delete the stored credentials. This can redirect future payments to the attacker's Stripe account or disable the integration. The CNA does not disclose the trigger parameters or option names.
|
1.1.2 |
CVE8.2
NVDPending
|