CVE-2026-81423: Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler

Q: Who can exploit this issue?

An attacker does not need to authenticate. They can supply a URL to the plugin's IPN handler and cause visitors who reach the crafted endpoint to be redirected to an arbitrary external site.

Q: Which installations are affected?

Installations using Accept Stripe Payments versions before 2.1.4 are affected. The provided information does not identify any configuration prerequisite beyond use of a vulnerable plugin version.

Q: What is the practical impact?

The redirect can send visitors to attacker-controlled external websites. This can support phishing by making a malicious destination appear to originate from a legitimate WordPress site.

Published Sep 5, 2026

Updated

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.

Affected Software

1 affected component

WordPress plugin "Accept Stripe Payments"<2.1.4

Event History

Sep 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker does not need to authenticate. They can supply a URL to the plugin's IPN handler and cause visitors who reach the crafted endpoint to be redirected to an arbitrary external site.

Which installations are affected?

Installations using Accept Stripe Payments versions before 2.1.4 are affected. The provided information does not identify any configuration prerequisite beyond use of a vulnerable plugin version.

What is the practical impact?

The redirect can send visitors to attacker-controlled external websites. This can support phishing by making a malicious destination appear to originate from a legitimate WordPress site.