CVE-2026-77758 — Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosur…

CVE-2026-77758

Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session PUBLISHED

Description (CNA)

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.

Affected (CNA)

Vendor / product	Versions
Unknown / Stripe Payment Forms by WP Full Pay	affected 0 before 8.5.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2d4fc012-9f80-43cc-b68d-96842700fe2f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.