CVE-2026-81424
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Accept Stripe Payments WordPress plugin before version 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.
Risk Assessment
An attacker can exploit this vulnerability to receive more expensive products or services without paying the full cost, leading to financial losses and order integrity issues.
Recommendation
Update the Accept Stripe Payments plugin to version 2.1.4 or later, which includes the product verification fix.
Other vulnerabilities in Accept Stripe Payments WordPress plugin
Original NVD description (English source)
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS