Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:29.710Z",
  "pubdate": "2026-08-26T06:16:29.710Z",
  "executiveSummary": "The Stripe Payment Forms by WP Full Pay WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient state validation in its customer portal session management.\nThe vulnerability allows unauthenticated, remote attackers to bypass confirmation requirements and retrieve sensitive subscription and billing data belonging to other customers.\nThe flaw affects all versions of the plugin prior to 8.5.1.\nBy failing to verify the completion of the customer portal confirmation step before returning requested data, the plugin exposes private information via direct object access.\nThe impact is significant, as it leads to the unauthorized disclosure of personally identifiable information (PII), subscription details, and billing information, potentially leading to identity theft or fraud.\nExploitation requires no authentication or special privileges, as the endpoint responsible for retrieving session data does not enforce authorization checks tied to the authenticated user's session.",
  "technicalDetails": "The vulnerability originates from a flaw in the confirmation state verification logic within the plugin's customer portal session handling mechanism. Specifically, the software fails to perform a server-side check to verify whether a customer has successfully completed the mandatory confirmation step required to finalize a portal session.\nIn a secure implementation, the backend should only grant access to subscription or billing data after validating that the user is authenticated and that the specific session identifier provided corresponds to a session that has reached a completed or confirmed state.\nIn the affected versions, the plugin's data retrieval function assumes that the existence of a session identifier is sufficient to grant access to the associated data. This creates an IDOR condition where an attacker can supply valid or guessed session identifiers to the relevant API endpoints.\nThe attack flow proceeds as follows: 1) An attacker identifies the endpoint responsible for fetching customer portal data. 2) The attacker bypasses the initial request for a 'confirmation' by interacting directly with the backend data retrieval function. 3) Because the function lacks conditional logic to verify the session status, the server returns the sensitive JSON payload associated with the target session identifier.\nThis behavior exposes the full contents of the subscription object, including but not limited to the customer's billing address, subscription status, last four digits of the payment method, and other relevant billing identifiers. Since the vulnerability resides within the application logic, the exploitation is performed over a network via standard HTTP requests, requiring no prior interaction or special privileges on the target WordPress installation.\nBecause the server does not differentiate between a pending session and a completed session during data retrieval, the attacker successfully exfiltrates data by simply iterating through session identifiers or targeting specific known identifiers. This allows for unauthorized access to third-party data, compromising the privacy and integrity of the subscription management process."
}