CVE-2026-81424: Accept Stripe Payments Plugin Auth Bypass

CVE-2026-81424 Overview

CVE-2026-81424 affects the Accept Stripe Payments WordPress plugin in versions before 2.1.4. The plugin fails to verify that the product fulfilled at checkout matches the product the authoritative Stripe payment was made for. It checks only that the amount paid is at least the referenced product's price. Unauthenticated attackers who complete a genuine payment can obtain fulfillment for a different product priced at or below what they paid. This is an Insecure Direct Object Reference issue [CWE-639] impacting e-commerce integrity on affected WordPress sites.

Critical Impact
Attackers who make a legitimate low-value payment can trigger fulfillment for a different, equal- or lower-priced product without paying the correct price for it.

Affected Products

Accept Stripe Payments WordPress plugin versions prior to 2.1.4
WordPress sites using the plugin for Stripe checkout and product fulfillment
Any storefront relying on the plugin's default price-only validation logic

Discovery Timeline

2026-09-05 - CVE-2026-81424 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-81424

Vulnerability Analysis

The flaw is a business logic error in the plugin's post-payment fulfillment routine. When a checkout completes, the plugin reconciles the Stripe payment amount with a product reference supplied through the request context. It confirms that the paid amount meets or exceeds the referenced product's price, but it does not confirm that the referenced product is the same product the Stripe payment authorization was actually created for.

This missing binding between the payment intent and the product identifier lets an attacker submit a request that references a different product than the one Stripe authorized. Because the price check succeeds whenever the paid amount is greater than or equal to the referenced product's price, the plugin fulfills the substituted product. The result is an integrity failure in the order fulfillment workflow.

Root Cause

The root cause is an Insecure Direct Object Reference [CWE-639]. The product identifier used for fulfillment is treated as attacker-controllable input without cross-checking it against the authoritative product identifier bound to the Stripe payment intent. Server-side validation compares prices only, not product identity.

Attack Vector

Exploitation requires network access to the checkout flow and no authentication or user interaction on the victim's side. An attacker pays for a low-priced product legitimately, then manipulates the fulfillment request to reference a different product whose price is less than or equal to the amount paid. The plugin accepts the mismatch and fulfills the substituted product. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-81424

Indicators of Compromise

Stripe payment records where the authorized product identifier does not match the fulfilled product recorded in WordPress order logs.
Fulfillment events for higher-value or premium products tied to payment intents authorized for lower-priced items.
Repeated small-value payments from the same customer followed by fulfillment of different products.

Detection Strategies

Reconcile Stripe dashboard payment intents against plugin order records and flag any product identifier mismatches.
Audit WordPress database order tables for fulfillment entries whose associated Stripe payment_intent metadata references a different product SKU.
Monitor HTTP requests to the plugin's checkout completion endpoints for tampered product identifiers.

Monitoring Recommendations

Enable verbose logging on the Accept Stripe Payments plugin and forward web server access logs to a centralized analytics platform.
Alert on refund disputes or customer complaints referencing incorrect products delivered after payment.
Track order-value distributions and investigate anomalies where fulfilled product prices exceed captured payment amounts.

How to Mitigate CVE-2026-81424

Immediate Actions Required

Update the Accept Stripe Payments WordPress plugin to version 2.1.4 or later on all affected sites.
Reconcile recent orders against Stripe payment intents to identify any fulfillment mismatches that already occurred.
Contact affected customers and Stripe support to remediate any confirmed fraudulent fulfillments.

Patch Information

The vendor addressed CVE-2026-81424 in Accept Stripe Payments version 2.1.4. The fix binds fulfillment to the product identifier associated with the authoritative Stripe payment instead of relying on a client-referenced product with a price-only check. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the plugin's checkout functionality until the update to 2.1.4 is applied.
Manually verify each order by matching the Stripe payment_intent product metadata to the WordPress fulfillment record before shipping or delivering digital goods.
Restrict the checkout endpoint using a web application firewall rule that validates the referenced product identifier against expected values.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update stripe-payments --version=2.1.4
wp plugin list --name=stripe-payments --fields=name,status,version