CVE-2026-12432

Name of the Vulnerable Software and Affected Versions WP Full Stripe Free versions prior to 8.4.4

Description The plugin contains a missing authorization flaw in the wpfs update failed payment status AJAX action. The update failed payment status() function fails to perform capability checks, nonce verification, or login requirements before executing $this->db->updatePaymentByEventId() using attacker-controlled POST parameters. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate database payment records, marking successful payments as failed and overwriting failure codes and messages.

Recommendations Update WP Full Stripe Free to version 8.4.4 or later.