CVE-2026-12432: WP Full Stripe Auth Bypass Vulnerability

CVE-2026-12432 Overview

CVE-2026-12432 is a Missing Authorization vulnerability [CWE-862] in the WP Full Stripe Free plugin for WordPress. The flaw affects all versions up to and including 8.4.3. The plugin exposes the wpfs_update_failed_payment_status AJAX action through both wp_ajax_ and wp_ajax_nopriv_ hooks. The underlying update_failed_payment_status() handler performs no capability check, no nonce verification, and no logged-in check. Unauthenticated attackers who obtain a valid Stripe Payment Intent ID can manipulate payment records, marking successful payments as failed and overwriting failure codes and messages.

Critical Impact
Unauthenticated attackers can tamper with payment status records in the WordPress database, corrupting merchant transaction history and financial reporting integrity.

Affected Products

WP Full Stripe Free plugin for WordPress versions up to and including 8.4.3
WordPress sites using Stripe.js checkout flows with the affected plugin
Merchants relying on WP Full Stripe payment status records for reconciliation

Discovery Timeline

2026-06-27 - CVE-2026-12432 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-12432

Vulnerability Analysis

The vulnerability resides in the WP Full Stripe Free plugin's handling of the wpfs_update_failed_payment_status AJAX endpoint. WordPress plugins commonly register AJAX handlers through two hooks: wp_ajax_{action} for authenticated users and wp_ajax_nopriv_{action} for unauthenticated requests. Registering the same handler on both hooks exposes the functionality to any anonymous visitor. The update_failed_payment_status() function then calls $this->db->updatePaymentByEventId() using attacker-controlled POST parameters. No capability check, nonce verification, or authentication check gates the write operation.

Root Cause

The root cause is a Missing Authorization flaw classified under [CWE-862]. The handler assumes that possession of a Stripe Payment Intent ID is sufficient proof of legitimacy. Payment Intent IDs are exposed to the customer browser during standard Stripe.js checkout flows, so they are not a secret. WordPress security best practices require server-side capability and nonce validation before any state-changing database write, and both are absent here.

Attack Vector

An unauthenticated attacker first obtains a valid Payment Intent ID for the target site. This identifier is visible in browser network traffic during any Stripe.js checkout. The attacker then issues a crafted POST request to admin-ajax.php with action=wpfs_update_failed_payment_status and attacker-supplied event ID, failure code, and failure message fields. The plugin writes those values directly into the payments table, changing the transaction record from successful to failed and injecting arbitrary text into failure metadata fields.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for the vulnerable handler registration.

Detection Methods for CVE-2026-12432

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wpfs_update_failed_payment_status originating from unauthenticated sessions or unexpected source IPs.
Payment records in the WP Full Stripe database transitioning from a successful status to a failed status without a corresponding Stripe webhook event.
Unusual or attacker-controlled strings appearing in payment failure code or failure message columns.
High-volume access to admin-ajax.php with the wpfs_update_failed_payment_status action from a single IP or user agent.

Detection Strategies

Enable WordPress request logging and alert on any unauthenticated POST that references the wpfs_update_failed_payment_status action.
Reconcile WP Full Stripe payment records against Stripe Dashboard event history to identify status changes not backed by legitimate webhook events.
Deploy a Web Application Firewall (WAF) rule that blocks requests to admin-ajax.php targeting this action without a valid nonce.

Monitoring Recommendations

Forward WordPress access logs and admin-ajax.php telemetry into a centralized SIEM or data lake for correlation with Stripe webhook activity.
Monitor database audit logs on the WP Full Stripe payments table for updates to status, failure_code, and failure_message columns.
Track anomalous outbound reconciliation discrepancies between merchant records and the Stripe Payments API.

How to Mitigate CVE-2026-12432

Immediate Actions Required

Update the WP Full Stripe Free plugin to a version later than 8.4.3 once a patched release is published by the vendor.
Restrict access to /wp-admin/admin-ajax.php at the WAF layer for the wpfs_update_failed_payment_status action until a fix is applied.
Audit the WP Full Stripe payments table for records whose status conflicts with the authoritative status in the Stripe Dashboard.
Rotate any Stripe API keys if evidence of broader tampering is discovered during the audit.

Patch Information

Review the vendor plugin repository and changelog at WordPress Plugin Change Log for the fix status. The Wordfence advisory referenced above tracks patched versions once released. Apply the update through the WordPress plugin manager and verify the version number after upgrade.

Workarounds

Deactivate the WP Full Stripe Free plugin until a patched version is installed if payment tampering risk is unacceptable.
Deploy a WAF rule to block or challenge POST requests to admin-ajax.php where the action parameter equals wpfs_update_failed_payment_status.
Use Stripe Dashboard as the authoritative source for payment status and configure downstream reporting to trust Stripe webhooks over local plugin records.
Implement a mu-plugin that unhooks the wp_ajax_nopriv_wpfs_update_failed_payment_status action until the vendor fix is applied.

bash

# Configuration example: temporary mitigation via mu-plugin
# Save as wp-content/mu-plugins/block-wpfs-nopriv.php
<?php
add_action('init', function () {
    remove_action(
        'wp_ajax_nopriv_wpfs_update_failed_payment_status',
        'update_failed_payment_status'
    );
}, 1);