CVE-2026-77789: WP Full Pay Authentication Bypass Flaw

CVE-2026-77789 Overview

CVE-2026-77789 affects the Stripe Payment Forms by WP Full Pay WordPress plugin in versions before 8.5.1. The plugin fails to verify that a subscription belongs to the customer bound to the requesting customer-portal session. An authenticated user with a valid portal session can cancel, reactivate, or modify subscriptions belonging to other customers. The flaw is an Insecure Direct Object Reference [CWE-639] tied to broken access control on subscription actions.

Critical Impact
Users with a confirmed customer-portal session can tamper with subscriptions owned by other customers, disrupting billing state and legitimate service continuity.

Affected Products

Stripe Payment Forms by WP Full Pay WordPress plugin versions prior to 8.5.1
WordPress sites operating the plugin's customer portal feature
Merchants using WP Full Pay subscription management via Stripe

Discovery Timeline

2026-08-26 - CVE-2026-77789 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77789

Vulnerability Analysis

The plugin exposes a customer-portal workflow that lets authenticated users manage their Stripe subscriptions. Actions such as cancel, reactivate, and modify accept a subscription identifier submitted by the client. The plugin authenticates the portal session but does not confirm that the referenced subscription belongs to the session's customer. An attacker who owns a valid portal session can substitute another customer's subscription identifier and have the action executed against it. The result is unauthorized modification of billing state, including cancellation of active subscriptions and reactivation of previously canceled ones. Confidentiality is not directly affected, but integrity of subscription records and availability of paid services for legitimate customers are impacted.

Root Cause

The root cause is missing authorization on subscription-scoped actions. The plugin trusts the subscription identifier supplied in the request instead of joining it against the customer bound to the current portal session. This is a classic Authorization Bypass Through User-Controlled Key pattern described by CWE-639. Session authentication proves who the caller is but does not enforce what objects they may act on.

Attack Vector

Exploitation requires a valid customer-portal session on the target site, which any registered customer can obtain. The attacker sends the plugin's normal subscription-action request but substitutes another customer's subscription identifier. The server processes the action without verifying ownership, mutating the target subscription. See the WPScan Vulnerability Report for the disclosure record. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2026-77789

Indicators of Compromise

Subscription cancel, reactivate, or modify actions in plugin logs where the acting portal session's customer identifier does not match the target subscription's customer.
Unexpected Stripe webhook events (customer.subscription.updated, customer.subscription.deleted) not initiated by the subscription owner.
Customer support tickets reporting unexplained cancellations or plan changes.

Detection Strategies

Correlate WordPress access logs for the plugin's portal endpoints with Stripe API audit events, flagging any mismatch between session user and affected customer object.
Alert on high-frequency subscription state changes from a single authenticated session or IP address.
Review database changes to plugin subscription tables where the initiating user does not own the row.

Monitoring Recommendations

Enable Stripe Dashboard event logging and export events to a centralized log store for correlation.
Monitor WordPress authentication and REST/admin-ajax activity targeting WP Full Pay portal handlers.
Track plugin version inventory across managed WordPress sites to identify hosts still below 8.5.1.

How to Mitigate CVE-2026-77789

Immediate Actions Required

Upgrade Stripe Payment Forms by WP Full Pay to version 8.5.1 or later on all WordPress installations.
Audit recent subscription state changes in Stripe and reconcile them against expected customer actions.
Rotate active customer-portal sessions to invalidate any attacker-held sessions.

Patch Information

The vendor addressed the missing ownership check in version 8.5.1. Upgrading to this release enforces that portal subscription actions operate only on subscriptions belonging to the session's customer. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the WP Full Pay customer portal feature until the plugin is upgraded to 8.5.1.
Restrict access to portal endpoints via a web application firewall rule that blocks subscription-action requests from unauthenticated or unexpected sources.
Require additional verification (email confirmation) before honoring cancel or modify actions on subscriptions.

bash

# Example: block plugin portal action endpoints at the WAF until patched
# Adjust path to match the plugin's actual portal handler on your site
location ~* /wp-admin/admin-ajax\.php {
    if ($arg_action ~* "^wpfp_(cancel|reactivate|update)_subscription$") {
        return 403;
    }
}