SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-77758

MEDIUM · CVSS 5.3 EPSS 0.27%

Source: NVD + CISA KEV + EPSS · Published 2026-08-26 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The Stripe Payment Forms plugin for WordPress versions prior to 8.5.1 is vulnerable due to inadequate verification of customer portal session confirmations, enabling unauthenticated users to access other customers' subscription and billing details. This could lead to unauthorized exposure of sensitive financial information. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data breaches.

CVE
CVE-2026-77758
Severity
MEDIUM
CVSS
5.3
EPSS
0.27%
WordPress

Original NVD Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.