CVE-2026-77789

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.1

Description An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session. This allows an authenticated user with a valid portal session to cancel, reactivate, or modify subscriptions belonging to other customers.

Recommendations Update Stripe Payment Forms by WP Full Pay to version 8.5.1 or later.