Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-26T06:16:29.810Z",
  "pubdate": "2026-08-26T06:16:29.810Z",
  "executiveSummary": "The Stripe Payment Forms by WP Full Pay plugin, specifically versions prior to 8.5.1, contains an Insecure Direct Object Reference (IDOR) vulnerability within its customer-portal session management logic.\nThis vulnerability stems from a failure to perform server-side authorization checks, specifically failing to validate the ownership of a subscription object before executing state-changing operations.\nAn authenticated user with a valid, confirmed customer-portal session can manipulate parameters to perform unauthorized actions, including the cancellation, modification, or reactivation of subscription records belonging to other users.\nThe risk implication is significant as it facilitates unauthorized access to private subscription data and administrative control over third-party billing agreements without requiring higher-level privileges.\nThe attack is limited to users who have already initiated a legitimate session, though it requires no cross-account authorization tokens, as the application assumes that any identifier passed within the session scope belongs to the requester.",
  "technicalDetails": "The vulnerability resides in the application's subscription management module, which handles requests from users within the Stripe-integrated customer portal. The root cause is a lack of rigorous access control validation regarding the association between the authenticated session user and the subscription ID being processed.\nWhen a user interacts with the portal to manage their subscription, the application receives a request containing identifiers for the subscription object. The backend processes these requests by trusting the provided ID without verifying that the object belongs to the requester's Stripe Customer ID.\nTo exploit this, an attacker must possess a valid, active portal session. By intercepting or manually crafting requests destined for the subscription management endpoints, the attacker can substitute the intended subscription ID with an arbitrary ID belonging to another user. Because the backend logic omits an 'ownership check' against the database or the Stripe API, the server executes the requested action—such as 'cancel' or 'update'—against the victim's subscription record.\nThe exploit flow is as follows: 1) The attacker initiates a legitimate session in the Stripe Payment Forms portal. 2) The attacker identifies the API or internal endpoint responsible for handling subscription modifications. 3) The attacker identifies a target subscription ID through enumeration or other reconnaissance techniques. 4) The attacker sends a crafted POST/GET request to the plugin endpoint, injecting the target's subscription ID into the request body or URI parameters. 5) The server processes the request, fails to cross-reference the session user's ID with the subscription's owner ID, and commits the unauthorized change to the victim's account.\nThis vulnerability is classified as an IDOR, which allows for unauthorized horizontal privilege escalation. Since the application fails to enforce the principle of least privilege, the integrity of all customer subscription states is compromised. Post-exploitation, an attacker can effectively disrupt service for other users, induce unwanted billing changes, or manipulate subscription tiers, leading to potential financial discrepancies and loss of customer trust.\nThe issue affects all versions of the Stripe Payment Forms by WP Full Pay plugin below 8.5.1. Authentication is required to start the session, but no administrative privileges are necessary to perform the unauthorized actions."
}