CVE-2026-74991 Overview
CVE-2026-74991 is a broken access control vulnerability in the WPForms plugin for WordPress versions before 2.0.2. The plugin fails to verify that a Stripe payment object submitted through a public form actually belongs to the form itself. Unauthenticated attackers can abuse this flaw to trigger full refunds and immediate subscription cancellations against unrelated payments on the site owner's Stripe account. The issue is tracked under CWE-284: Improper Access Control.
Critical Impact
Remote, unauthenticated attackers can refund arbitrary Stripe payments and cancel active subscriptions tied to the site owner's Stripe account, causing direct revenue loss and service disruption.
Affected Products
- WPForms WordPress plugin versions prior to 2.0.2
- WordPress sites using WPForms with the Stripe payment integration enabled
- Any Stripe account linked to a vulnerable WPForms installation, including payments created by other applications on that account
Discovery Timeline
- 2026-09-24 - CVE-2026-74991 published to the National Vulnerability Database (NVD)
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-74991
Vulnerability Analysis
The vulnerability resides in how WPForms processes Stripe payment identifiers received from public form submissions. When a submission includes a Stripe payment object reference, the plugin acts on that object without first confirming it was created by the form being submitted. An attacker who knows or can enumerate a valid Stripe payment or subscription identifier belonging to the same Stripe account can submit that identifier through a public WPForms form. The plugin then issues refund or cancellation calls to the Stripe API against the attacker-supplied object. Because the affected code path is reachable without authentication, exploitation requires no user credentials.
Root Cause
The root cause is missing ownership validation on Stripe payment objects supplied by untrusted input. WPForms trusts the client-supplied payment reference and invokes privileged Stripe API actions against it. The plugin does not cross-check that the object was created in the context of the current form or site operation. This design flaw maps to CWE-284: Improper Access Control.
Attack Vector
Exploitation is performed over the network against any WordPress site running a vulnerable WPForms version with Stripe integration enabled. The attacker crafts a public form submission that references a target Stripe payment or subscription identifier. The plugin forwards the request to Stripe, resulting in a full refund of the referenced charge or cancellation of the referenced subscription. The attack affects payments and subscriptions created by other applications on the same Stripe account, extending impact beyond WPForms-originated transactions.
No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-74991
Indicators of Compromise
- Unexpected charge.refunded or customer.subscription.deleted events in Stripe account event logs that do not correlate to legitimate customer or administrator activity
- Refunds issued against Stripe charges that were not originated by WPForms
- Spikes in POST requests to WPForms public submission endpoints referencing Stripe payment intent or subscription identifiers
- Customer complaints about unexpected refunds or canceled subscriptions tied to the merchant's Stripe account
Detection Strategies
- Correlate Stripe webhook events with WordPress access logs to identify refunds or cancellations triggered by form submissions from unknown sources
- Review WPForms submission logs for payloads containing Stripe object identifiers that do not match the submitting form's transaction history
- Monitor WordPress plugin inventory to flag any installation of WPForms at a version earlier than 2.0.2
Monitoring Recommendations
- Enable and retain Stripe Dashboard event logs with full detail, and forward them to a centralized logging platform
- Alert on refund volumes or subscription cancellation rates that exceed baseline thresholds
- Monitor web server logs for anomalous unauthenticated POST traffic to WPForms endpoints originating from a small number of source IPs
How to Mitigate CVE-2026-74991
Immediate Actions Required
- Upgrade the WPForms plugin to version 2.0.2 or later on all WordPress sites
- Audit recent Stripe refunds and subscription cancellations for unauthorized activity and initiate reversal where possible
- Rotate Stripe API keys if unauthorized API activity is confirmed
- If immediate patching is not possible, disable the WPForms Stripe integration or deactivate the plugin
Patch Information
The vendor has addressed the issue in WPForms version 2.0.2. Site administrators should update through the WordPress plugin administration interface or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily disable the WPForms plugin or its Stripe payment integration until the update to 2.0.2 is applied
- Restrict access to WPForms submission endpoints using a web application firewall rule that blocks requests containing unexpected Stripe object identifiers
- Use a dedicated Stripe account or restricted API key scoped only to WPForms to limit blast radius to WPForms-created objects
# Example: verify the installed WPForms version via WP-CLI and update
wp plugin get wpforms-lite --field=version
wp plugin update wpforms-lite --version=2.0.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.