WPFormify public callbacks permit Stripe credential replacement or deletion
WPFormify through 1.1.1 hooks wpf_stripe_callback_success() and wpf_stripe_disconnect() to admin_init without capability or nonce checks. Because admin-post.php is publicly reachable and fires admin_init, an unauthenticated attacker can invoke the success path with attacker-controlled Stripe credentials or invoke the disconnect path to delete the stored credentials. This can redirect future payments to the attacker's Stripe account or disable the integration. The CNA does not disclose the trigger parameters or option names.
- Component
- WPFormify – Stripe Payments with Form and Checkout
- Plugin slug
wpformify- Affected
- <= 1.1.1
- Safe version
1.1.2- Published
- Aug 05, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update WPFormify to 1.1.2 or later. The upstream changeset identifies 1.1.2 as the fixed tag. Reconnect Stripe with trusted credentials, rotate exposed keys and reconcile payment destinations and transactions if a vulnerable version was reachable.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L