CVE-2026-81424: Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
The attacker must complete a genuine payment, then cause checkout fulfilment to reference a different product whose price is equal to or lower than the amount paid. No authentication is required.
Which products can be obtained through the flaw?
A vulnerable checkout can fulfil a different product from the one actually paid for, provided the referenced product costs no more than the payment amount. Higher-priced products are not described as affected by this condition.
How can I determine whether my site may be affected?
Sites using the Accept Stripe Payments WordPress plugin before version 2.1.4 may be affected. Review completed orders for cases where the fulfilled product differs from the product associated with the authoritative payment while the fulfilled product price is equal to or lower than the amount paid.