Vulnerability in WordPress (CVE-2026-6627, CVSS 8.2)

Summary

Vulnerability in WordPress (CVE-2026-6627). Data can be tampered with by attackers. Exploitable via admin_init.

Original description

The description as published by the source.

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the wpf_stripe_callback_success() and wpf_stripe_disconnect() functions, both hooked to admin_init. The admin_init hook fires on admin-post.php which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

WordPress用プラグインWPFormify – Stripe Payments with Form and Checkoutにおいて、未認証の攻撃者によるStripeの支払い資格情報の無許可の修正および削除が可能な脆弱性が発見されました。これにより、攻撃者はサイトのStripe API資格情報を改ざんし、自分のStripeアカウントに送金先を変更することができます。

❓ What is the problem

WordPress用のプラグインでStripeの支払い資格情報が無許可に修正・削除される脆弱性。

📍 Affected scope

WPFormifyプラグインのバージョン1.1.1以下。

🔥 Severity

未認証の攻撃者が支払情報を改ざんし、自らのアカウントにリダイレクト可能。

🔧 How to fix

最新版へのアップデートで脆弱性を修正。

🛡️ Workaround

情報なし

🔍 Detection

wpformifyプラグインのバージョンを確認することで影響有無を判断可能。

Summary

Original description

AI summary

References