CVE-2026-77758: WP Full Pay Information Disclosure Flaw

CVE-2026-77758 Overview

The Stripe Payment Forms by WP Full Pay WordPress plugin contains an information disclosure vulnerability in versions before 8.5.1. The plugin fails to verify that a customer portal session has completed its confirmation step before returning data. Unauthenticated attackers can exploit this flaw to read another customer's subscription and billing information over the network. The weakness is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve other customers' subscription and billing details without any user interaction.

Affected Products

Stripe Payment Forms by WP Full Pay WordPress plugin versions prior to 8.5.1
WordPress sites running WP Full Pay for Stripe subscription management
Customer portal sessions handled by the affected plugin versions

Discovery Timeline

2026-08-26 - CVE-2026-77758 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77758

Vulnerability Analysis

The vulnerability resides in the customer portal session handling logic of the WP Full Pay plugin. The plugin returns session-associated customer data before confirming that the portal session has completed its verification step. An attacker who obtains or guesses a valid session reference can request the associated data through the plugin's public endpoint. The server responds with billing and subscription information belonging to another customer.

The issue is a business logic flaw combined with missing authorization. Sensitive data flows to unauthenticated clients because the confirmation state is never enforced. The Exploit Prediction Scoring System (EPSS) currently rates active exploitation likelihood as low.

Root Cause

The plugin implements a multi-step customer portal flow but does not validate the completion state of the session before returning protected data. The confirmation step, which should gate access to subscription and billing records, is treated as advisory rather than mandatory. This violates the authorization requirements of the customer portal workflow.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends a crafted request to the plugin's portal session endpoint referencing another customer's session. The server returns subscription identifiers, billing addresses, and related Stripe customer metadata. No privileges or prior account access are required. See the WPScan Vulnerability Report for reference details.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by requesting customer portal
// session data before the confirmation step has completed.

Detection Methods for CVE-2026-77758

Indicators of Compromise

Repeated anonymous requests to WP Full Pay customer portal endpoints from a single IP address
Portal session data responses returned to clients that did not complete the confirmation step
Unexpected access patterns to /wp-json/ or plugin AJAX handlers associated with WP Full Pay

Detection Strategies

Review web server logs for unauthenticated requests to WP Full Pay customer portal routes and correlate with session identifiers
Enable verbose logging on the plugin to record session state transitions and flag data returns that precede confirmation
Compare Stripe subscription access events against expected customer authentication events in the WordPress audit trail

Monitoring Recommendations

Monitor for anomalous volumes of portal session requests from unauthenticated sources
Track HTTP responses containing subscription or billing fields served to sessions without a completed confirmation state
Alert on repeated 200 OK responses to portal session endpoints preceding any customer login event

How to Mitigate CVE-2026-77758

Immediate Actions Required

Upgrade the Stripe Payment Forms by WP Full Pay plugin to version 8.5.1 or later on all WordPress sites
Audit recent web server and plugin logs for signs of unauthenticated portal session data retrieval
Rotate any exposed Stripe customer portal session tokens and notify affected customers if disclosure is confirmed

Patch Information

The vendor addressed the flaw in WP Full Pay version 8.5.1 by enforcing that the customer portal confirmation step completes before session data is returned. Refer to the WPScan Vulnerability Report for advisory metadata and fix details.

Workarounds

Disable the WP Full Pay customer portal feature until the plugin can be upgraded to 8.5.1
Restrict access to plugin portal endpoints using a web application firewall rule that blocks unauthenticated requests
Temporarily deactivate the plugin on production sites if the customer portal is not in active use

bash

# Update the WP Full Pay plugin using WP-CLI
wp plugin update stripe-payment-forms-lite --version=8.5.1
wp plugin list | grep full-pay