CVE-2026-16734: Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Stripe Payment Forms by WP Full Payto a version that resolves this vulnerability.Fixed in 8.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16734?
The severity of CVE-2026-16734 is classified as risk level 62.
How do I fix CVE-2026-16734?
To fix CVE-2026-16734, update the WP Full Pay Stripe Payment Forms plugin to version 8.5.2 or later.
What impact does CVE-2026-16734 have on my WordPress site?
CVE-2026-16734 allows unauthenticated visitors to manipulate payment intent amounts, potentially leading to financial loss.
What are the affected versions for CVE-2026-16734?
CVE-2026-16734 affects WP Full Pay Stripe Payment Forms plugin versions prior to 8.5.2.
Is authentication required to exploit CVE-2026-16734?
No, CVE-2026-16734 can be exploited by unauthenticated visitors.