Unauthenticated Stripe Credential Modification in WPFormify WordPress Plugin

The WPFormify - Stripe Payments with Form and Checkout plugin for WordPress, in versions up to and including 1.1.1, contains a critical authentication bypass vulnerability (CVE-2026-6627). The flaw resides in the wpf_stripe_callback_success() and wpf_stripe_disconnect() functions. These functions, which handle critical Stripe integration settings, are incorrectly hooked to the admin_init action. Because admin_init fires during requests to admin-post.php, and these functions lack necessary capability checks or nonce verification, unauthenticated remote attackers can interact with these endpoints. By sending crafted requests to admin-post.php, an attacker can overwrite existing Stripe API keys with their own, effectively redirecting all customer payments to a malicious account. Alternatively, an attacker may trigger the disconnect function to disrupt the site's payment processing capabilities entirely. This vulnerability poses a high financial risk to any organization using the plugin for payment collection.

Impact

Successful exploitation allows unauthenticated attackers to hijack payment flows, leading to complete loss of transaction revenue or service disruption. All WordPress sites running WPFormify version 1.1.1 or lower are affected. There is no information provided regarding the total number of victims, but the nature of the vulnerability facilitates direct financial fraud.

Recommendation

• Update the WPFormify - Stripe Payments with Form and Checkout plugin to the latest version immediately to remediate the missing capability checks.
• Review WordPress audit logs for unexpected POST requests to admin-post.php, specifically those originating from unauthenticated sessions that invoke Stripe-related parameters.
• Audit current Stripe configuration settings in the WordPress admin panel to verify that the configured API keys match authorized merchant account values.