CVE-2026-16734: WP Full Pay Auth Bypass Vulnerability

CVE-2026-16734 Overview

CVE-2026-16734 affects the Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.2. The plugin fails to verify that the caller owns the Stripe payment intent referenced by two unauthenticated AJAX actions. An unauthenticated visitor can reuse a nonce embedded in every public payment-form page to alter the amount of an existing payment intent. The plugin then propagates the manipulated amount to Stripe using the store's secret key. Version 8.5.0 introduced an ownership check, but it was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions exposed.

Critical Impact
Unauthenticated attackers can manipulate Stripe payment intent amounts, enabling fraudulent purchases at attacker-chosen prices from any WordPress site running the affected plugin.

Affected Products

Stripe Payment Forms by WP Full Pay WordPress plugin versions prior to 8.5.2
WordPress sites accepting Stripe payments through WP Full Pay
E-commerce deployments relying on the plugin's pricing-recalculation AJAX handler

Discovery Timeline

2026-08-06 - CVE-2026-16734 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-16734

Vulnerability Analysis

The vulnerability is a broken access control flaw in unauthenticated AJAX endpoints exposed by the WP Full Pay plugin. Stripe's payment intent model expects the merchant server to authoritatively determine payment amounts. WP Full Pay accepts a client-supplied payment intent identifier and updates the intent server-side using the store's Stripe secret key without confirming that the caller created or owns that intent.

Because the nonce used to gate the AJAX actions is rendered in every public page containing a payment form, any unauthenticated visitor can obtain it. The attacker then references any known payment intent identifier and triggers a server-side update. The plugin author added an ownership check in 8.5.0, but the fix covered only one of three payment-intent handlers. This classifies as a business logic flaw combined with missing authorization on sensitive state-changing operations.

Root Cause

The root cause is missing ownership verification on the pricing-recalculation and payment-intent-update AJAX actions. The plugin relies on a public nonce as its sole authorization gate, treating nonce possession as proof of legitimate ownership. Nonces in WordPress are designed to prevent CSRF, not to establish identity. Without binding a payment intent to a session or verifying that the caller initiated it, the handlers accept arbitrary intent identifiers and amount values.

Attack Vector

An unauthenticated attacker retrieves the public nonce by loading any page containing a WP Full Pay payment form. The attacker initiates a legitimate checkout to obtain a payment intent identifier, then issues an AJAX request to the pricing-recalculation or payment-intent-update endpoint. The request supplies the target intent identifier and an attacker-chosen amount. The plugin forwards the update to the Stripe API using the merchant's secret key, causing the payment to complete at the manipulated price. Refer to the WPScan Vulnerability Report for handler-level technical details.

Detection Methods for CVE-2026-16734

Indicators of Compromise

Stripe dashboard entries showing payment intent amount updates that do not match displayed product prices
Successful payments with amounts significantly below the catalog price for the corresponding SKU
Repeated AJAX POST requests to WP Full Pay payment-intent-update or pricing-recalculation actions from a single IP without preceding cart navigation
Payment intent modification events in Stripe API logs originating from unauthenticated site sessions

Detection Strategies

Reconcile Stripe payment amounts against WordPress order records and flag mismatches
Enable Stripe webhook logging for payment_intent.amount_capturable_updated and compare against expected cart totals
Inspect web server access logs for unauthenticated POST requests to admin-ajax.php referencing WP Full Pay action names
Alert on order fulfillment where the paid amount is below a configured minimum threshold

Monitoring Recommendations

Ingest WordPress access logs and Stripe API events into a centralized SIEM or data lake for correlation
Track the version of WP Full Pay installed across all WordPress properties and alert on installations below 8.5.2
Monitor for anomalous request volumes against payment-form AJAX endpoints
Review chargeback and refund trends for evidence of exploitation before the patch was applied

How to Mitigate CVE-2026-16734

Immediate Actions Required

Update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.2 or later on every affected WordPress site
Audit Stripe transaction history since the plugin was installed and identify payments with manipulated amounts
Rotate the Stripe secret key if unauthorized payment intent modifications are confirmed
Suspend checkout on sites that cannot be patched immediately

Patch Information

The vendor released version 8.5.2, which extends the ownership check introduced in 8.5.0 to the pricing-recalculation and payment-intent-update handlers. Administrators should upgrade through the WordPress plugin management interface or via WP-CLI. Consult the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the WP Full Pay plugin until version 8.5.2 can be installed
Restrict access to admin-ajax.php payment-form actions using a web application firewall rule that validates request origin and referrer
Configure Stripe Radar rules to block payment captures below expected product price thresholds
Require manual review of Stripe transactions before order fulfillment during the patch window

bash

# Update WP Full Pay to the patched version using WP-CLI
wp plugin update stripe-payment-forms-lite --version=8.5.2
wp plugin list --name=stripe-payment-forms-lite --fields=name,status,version