CVE-2026-6627

Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2

Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success() and wpf stripe disconnect() functions, which are hooked to admin init on the admin-post.php endpoint, lack capability checks and nonce verification. A nonce is a unique token used to prevent replay attacks by ensuring a request is intentional and authentic. This flaw allows an attacker to overwrite Stripe API credentials to redirect payments to their own account or completely disconnect the Stripe integration.

Recommendations Update WPFormify – Stripe Payments with Form and Checkout to version 1.1.2 or later. As a temporary workaround, restrict access to the admin-post.php endpoint or disable the wpf stripe callback success() and wpf stripe disconnect() functions until the update is applied.