CVE-2026-42378
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
There is a broken authentication issue in WP Full Stripe Free versions up to 8.4.1, which may lead to unauthorized access to user accounts.
Risk Assessment
The organization may be exposed to unauthorized user actions, potentially resulting in data loss or privacy breaches.
Recommendation
It is recommended to update the WP Full Stripe Free plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP Full Stripe Free
See all- CVE-2026-62073High
The WP Full Stripe Free plugin in versions up to 8.5.6 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing access controls allow unauthorized access to functions or data.
- CVE-2026-61960High
The WP Full Stripe Free plugin versions up to 8.5.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
- CVE-2026-12432Medium
The WP Full Stripe Free plugin for WordPress up to version 8.4.3 lacks authorization in the wpfs_update_failed_payment_status AJAX action. Unauthenticated attackers with a valid Stripe Payment Intent ID can manipulate payment records in the database, marking successful payments as failed and overwriting error codes.
Original NVD description (English source)
Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS