CVE-2026-6627: WPFormify Auth Bypass Vulnerability

CVE-2026-6627 Overview

CVE-2026-6627 is a missing authorization vulnerability [CWE-862] in the WPFormify – Stripe Payments with Form and Checkout plugin for WordPress. The flaw affects all versions up to and including 1.1.1. The wpf_stripe_callback_success() and wpf_stripe_disconnect() functions are hooked to admin_init without capability checks or nonce verification. Because admin_init fires on admin-post.php, which is reachable without authentication, unauthenticated attackers can overwrite the site's Stripe API credentials or delete the Stripe integration entirely.

Critical Impact
Unauthenticated attackers can redirect Stripe payments to attacker-controlled accounts by overwriting stored API credentials, resulting in direct financial theft from affected WordPress merchants.

Affected Products

WPFormify – Stripe Payments with Form and Checkout plugin for WordPress
All versions up to and including 1.1.1
Fixed in version 1.1.2

Discovery Timeline

2026-08-05 - CVE-2026-6627 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-6627

Vulnerability Analysis

The vulnerability resides in the Stripe authorization module of the WPFormify plugin, specifically in modules/payments/stripe_authorization.php. Two functions handle Stripe OAuth callback processing and disconnection: wpf_stripe_callback_success() and wpf_stripe_disconnect(). Both functions are registered against the WordPress admin_init action hook.

The admin_init hook is a common source of authorization flaws in WordPress plugins. It executes not only in the authenticated admin dashboard but also on requests to admin-post.php and admin-ajax.php, endpoints reachable by unauthenticated users. Without an explicit current_user_can() check or a check_admin_referer() nonce validation, any handler bound to admin_init runs for anonymous visitors.

An attacker abusing wpf_stripe_callback_success() can supply crafted parameters that cause the plugin to persist attacker-controlled Stripe API keys into the site's options table. Once written, all subsequent checkout transactions route through the attacker's Stripe account. Alternatively, invoking wpf_stripe_disconnect() deletes the stored credentials and disables legitimate payment processing, producing a denial-of-service impact against the merchant.

Root Cause

The root cause is the absence of two mandatory WordPress security primitives: capability checks that restrict privileged operations to administrators, and nonce verification that binds requests to an authenticated session. Both callbacks trust the presence of the hook alone as an implicit access control boundary, which it is not.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker issues an unauthenticated HTTP request to admin-post.php with parameters that trigger the vulnerable callback handlers. No user interaction, authentication, or prior compromise is required. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for technical details of the vulnerable code paths.

Detection Methods for CVE-2026-6627

Indicators of Compromise

Unexpected changes to Stripe API credentials stored in the WordPress wp_options table, particularly WPFormify-related option keys.
Anonymous HTTP requests to /wp-admin/admin-post.php referencing WPFormify Stripe callback parameters in access logs.
Sudden drop in Stripe transactions reaching the legitimate merchant account, or reports of payments routed to unknown accounts.
Stripe integration status showing as disconnected without an administrator initiating the action.

Detection Strategies

Monitor WordPress audit logs for modifications to plugin option values by unauthenticated or unexpected users.
Deploy a Web Application Firewall (WAF) rule to flag unauthenticated requests to admin-post.php containing WPFormify Stripe parameters.
Compare stored Stripe publishable and secret key fingerprints against a known-good baseline on a scheduled basis.
Correlate Stripe dashboard payout destinations with the merchant's expected bank account on record.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/wpformify/ directory and on the WordPress options table.
Alert on any writes to Stripe credential option keys originating from requests without an authenticated administrator session.
Aggregate WordPress plugin vulnerability feeds into the SIEM to receive automated notification for newly disclosed WPFormify advisories.

How to Mitigate CVE-2026-6627

Immediate Actions Required

Update the WPFormify – Stripe Payments plugin to version 1.1.2 or later without delay.
Rotate all Stripe API keys through the Stripe dashboard after updating, in case credentials were overwritten or exposed.
Verify payout bank account settings in the Stripe dashboard and confirm no unauthorized destinations have been configured.
Review recent transactions for anomalies and reconcile against expected merchant activity.

Patch Information

The vendor addressed the vulnerability in WPFormify version 1.1.2. The fix adds capability checks and nonce verification to the affected callback handlers. Refer to the WordPress Change Log Update for the specific code changes applied by the maintainer.

Workarounds

If immediate patching is not possible, deactivate and remove the WPFormify plugin until the update can be applied.
Restrict access to /wp-admin/admin-post.php at the WAF or reverse proxy layer to authenticated administrator IP ranges.
Temporarily revoke the Stripe API keys associated with the site to prevent redirection of payments while remediation is in progress.

bash

# Example WAF rule concept to block unauthenticated WPFormify Stripe callback abuse
# (Adapt to your WAF syntax - ModSecurity example)
SecRule REQUEST_URI "@contains /wp-admin/admin-post.php" \
    "chain,deny,status:403,id:1026627,msg:'Block unauthenticated WPFormify Stripe callback'"
  SecRule ARGS_NAMES "@rx wpf_stripe_(callback_success|disconnect)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"