CVE-2026-42752: Stripe Payments Auth Bypass Vulnerability

CVE-2026-42752 Overview

CVE-2026-42752 is an unauthenticated bypass vulnerability affecting the Stripe Payments plugin for WordPress in versions up to and including 2.0.98. The flaw is classified under [CWE-440] (Expected Behavior Violation), indicating that the plugin does not enforce a security control in the way its design intends. Network-based attackers can exploit the issue without authentication and without user interaction, resulting in limited confidentiality and integrity impact on the affected site. The vulnerability was published to the National Vulnerability Database on June 15, 2026.

Critical Impact
Remote, unauthenticated attackers can bypass an intended security control in Stripe Payments <= 2.0.98, manipulating payment-related logic on affected WordPress sites.

Affected Products

WordPress Stripe Payments plugin versions <= 2.0.98
WordPress sites that expose the plugin's public endpoints to the internet
E-commerce deployments relying on the plugin for checkout flows

Discovery Timeline

2026-06-15 - CVE-2026-42752 published to the National Vulnerability Database
2026-06-17 - CVE record last modified in NVD

Technical Details for CVE-2026-42752

Vulnerability Analysis

The vulnerability allows an unauthenticated attacker to bypass a security control implemented by the Stripe Payments plugin. Because the attack vector is network-based and complexity is low, an attacker only needs to reach the WordPress site over HTTP or HTTPS. No privileges or user interaction are required, which lowers the barrier to exploitation against any internet-facing WordPress installation running a vulnerable plugin version.

The scope is unchanged, meaning the impact remains within the WordPress application boundary. Exploitation can affect both the confidentiality and integrity of plugin-managed data, such as payment metadata, configuration values, or checkout state. Availability of the site is not directly impacted by the flaw.

For full technical context, refer to the Patchstack Vulnerability Report.

Root Cause

The root cause is mapped to [CWE-440] Expected Behavior Violation. The plugin's enforcement logic deviates from its documented or intended security behavior, leaving a control that can be circumvented under specific request conditions. This pattern typically arises when validation checks, capability tests, or nonce verifications are inconsistently applied across related code paths.

Attack Vector

Exploitation occurs over the network against the public surface of the WordPress site. An unauthenticated attacker crafts HTTP requests targeting plugin endpoints that should enforce the bypassed control. Because no authentication is required, automated scanning and mass exploitation of exposed installations are feasible. No verified public proof-of-concept code is currently available, and the EPSS data indicates a low near-term exploitation probability at the time of publication.

No verified exploitation code is published. The vulnerability is described in prose because no sanitized proof-of-concept is available from authoritative sources.

Detection Methods for CVE-2026-42752

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to Stripe Payments plugin endpoints under /wp-content/plugins/stripe-payments/ or related admin-ajax.php actions
Unexpected modifications to payment-related options, transactions, or order records in the WordPress database
Spikes in requests to plugin-specific AJAX actions originating from a small set of source IPs

Detection Strategies

Inventory all WordPress installations and identify those running Stripe Payments <= 2.0.98 using plugin version scans
Inspect web server access logs for anomalous request patterns targeting plugin handlers without authenticated session cookies
Correlate WordPress audit logs with HTTP traffic to identify state changes triggered by unauthenticated requests

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM or data lake for retention and correlation
Alert on requests to plugin endpoints that succeed without an authenticated user context
Monitor outbound traffic to Stripe API endpoints for unexpected order activity initiated outside of normal checkout flows

How to Mitigate CVE-2026-42752

Immediate Actions Required

Update the Stripe Payments plugin to a version later than 2.0.98 as soon as a fixed release is available from the vendor
Restrict access to WordPress administrative and AJAX endpoints using a web application firewall (WAF) ruleset
Audit recent payment, order, and configuration changes for evidence of tampering since the plugin was installed

Patch Information

Review the Patchstack Vulnerability Report for fixed version guidance and patch availability. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI once published.

Workarounds

Temporarily disable the Stripe Payments plugin on non-production or low-traffic sites until a patched version is deployed
Apply virtual patching through a WAF to block unauthenticated requests to vulnerable plugin endpoints
Enforce IP allow-listing on administrative paths to reduce exposure of plugin handlers to untrusted networks

bash

# Example: update the plugin using WP-CLI once a fixed version is available
wp plugin update stripe-payments --version=<fixed-version>
wp plugin list --name=stripe-payments --fields=name,status,version