CVE-2026-80311

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.5

Description An Insecure Direct Object Reference (IDOR) exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal session before processing a cancellation. This allows an authenticated user with a valid portal session to cancel subscriptions belonging to other customers, provided they know the specific subscription identifier. This identifier is high-entropy, meaning it is a complex string that is difficult to guess or enumerate.

Recommendations Update Stripe Payment Forms by WP Full Pay to version 8.5.5 or later.