CVE-2026-42378 Overview
CVE-2026-42378 is a broken authentication vulnerability affecting the WP Full Stripe Free WordPress plugin in versions up to and including 8.4.1. The flaw is categorized under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel). An authenticated attacker holding only a low-privilege Subscriber role can leverage the weakness to access information that should be restricted to higher-privileged accounts. The issue carries a CVSS 3.1 base score of 6.5, reflecting network-accessible exploitation with low complexity and high confidentiality impact. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.
Critical Impact
Authenticated Subscriber-level users can bypass intended authentication controls in WP Full Stripe Free <= 8.4.1 to access confidential payment and subscription data managed by the plugin.
Affected Products
- WP Full Stripe Free WordPress plugin versions <= 8.4.1
- WordPress sites with the plugin installed and accepting Subscriber registrations
- Stripe-integrated payment workflows exposed through the plugin
Discovery Timeline
- 2026-06-15 - CVE-2026-42378 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-42378
Vulnerability Analysis
The vulnerability resides in WP Full Stripe Free's handling of authenticated requests. The plugin exposes functionality that should be limited to administrative or owner-level identities but verifies only that a session belongs to a logged-in user. WordPress sites commonly permit open Subscriber registration, which means any visitor can obtain the minimum credential needed to reach the affected code paths.
The weakness aligns with [CWE-288], where an alternate request path skips the intended authorization check. An attacker authenticates as a Subscriber, then issues requests to plugin endpoints that read sensitive subscription, customer, or transaction data. The confidentiality impact is rated High, while integrity and availability are unaffected.
For full advisory context, see the Patchstack WordPress Vulnerability Report.
Root Cause
The plugin's request handlers enforce authentication but omit a capability check such as current_user_can() for privileged actions. As a result, the access control decision relies on session presence rather than role or capability. Any authenticated WordPress user, including the lowest-privilege Subscriber role, satisfies the check.
Attack Vector
Exploitation requires network access to the target WordPress site and a valid Subscriber account. The attacker logs in, then sends crafted HTTP requests to the vulnerable plugin endpoints. The server returns data that should be gated behind administrative privileges. No user interaction by an administrator is required.
No verified exploit code is publicly available. Refer to the vendor advisory for technical specifics.
Detection Methods for CVE-2026-42378
Indicators of Compromise
- Unexpected HTTP requests from Subscriber-level accounts targeting admin-ajax.php or REST routes registered by WP Full Stripe Free
- Access log entries showing low-privilege users retrieving payment, subscription, or customer records
- New Subscriber account registrations followed shortly by repeated plugin endpoint requests
Detection Strategies
- Audit WordPress wp_users and wp_usermeta tables for recently created Subscriber accounts with anomalous activity
- Review web server and WordPress access logs for plugin-specific AJAX actions invoked by non-administrator roles
- Compare installed plugin versions against 8.4.1 and flag any host running an affected build
Monitoring Recommendations
- Enable WordPress activity logging to capture role-based access to plugin endpoints
- Forward web server logs to a centralized analytics platform and alert on Subscriber-initiated requests to administrative routes
- Track outbound data volumes from the WordPress host to identify bulk extraction attempts
How to Mitigate CVE-2026-42378
Immediate Actions Required
- Update WP Full Stripe Free to a version later than 8.4.1 once the vendor publishes a fix
- Disable open user registration on WordPress sites that do not require it, reducing the pool of potential Subscriber attackers
- Review existing Subscriber accounts and remove any that are unrecognized or inactive
Patch Information
At the time of publication, the Patchstack WordPress Vulnerability Report lists the issue as affecting versions through 8.4.1. Administrators should monitor the plugin's WordPress.org page and apply the next maintenance release that addresses CVE-2026-42378.
Workarounds
- Deactivate WP Full Stripe Free until a patched release is available if payment functionality is not business-critical
- Restrict access to /wp-admin/admin-ajax.php and plugin REST endpoints using a Web Application Firewall rule that blocks Subscriber-level callers
- Set users_can_register to false in WordPress general settings to prevent unauthenticated visitors from acquiring Subscriber accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
