Unauthenticated Payment Status Update in WP Full Stripe Free

Executive Summary

The WP Full Stripe Free plugin for WordPress has a vulnerability called Missing Authorization in versions up to and including 8.4.3. This occurs via the wpfs_update_failed_payment_status AJAX action, which is accessible to both authenticated and unauthenticated users. The function handling this action does not perform any capability checks, nonce verification, or logged-in checks before updating payment records in the database.

Because of this, an attacker who can obtain a valid Stripe Payment Intent ID (which is normally exposed to customers during Stripe.js checkout) can manipulate payment records on the site. Specifically, they can mark previously successful payments as failed and overwrite failure codes and messages with values they supply.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to alter payment records on your WordPress site using the WP Full Stripe Free plugin. They can mark successful payments as failed and insert arbitrary failure codes and messages.

The impact includes potential disruption of payment processing records, causing confusion for both merchants and customers, possible financial discrepancies, and undermining trust in the payment system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the wpfs_update_failed_payment_status AJAX action being accessible without authorization, allowing manipulation of payment records via attacker-controlled POST parameters.

To detect exploitation attempts on your system or network, you can monitor HTTP POST requests targeting the wpfs_update_failed_payment_status AJAX endpoint.

• Use web server logs or network monitoring tools to filter for POST requests containing wpfs_update_failed_payment_status.
• Example command using grep on Apache logs: grep 'POST.*wpfs_update_failed_payment_status' /var/log/apache2/access.log
• Use tools like Wireshark or tcpdump to capture HTTP traffic and filter for POST requests to admin-ajax.php with the action parameter set to wpfs_update_failed_payment_status.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the WP Full Stripe Free plugin to a version later than 8.4.3 where this vulnerability is fixed.

If an update is not immediately available, restrict access to the wpfs_update_failed_payment_status AJAX action by implementing capability checks, nonce verification, or limiting access to authenticated users only.

Additionally, monitor your payment records for suspicious changes and consider temporarily disabling the plugin if possible until a patch is applied.

Useful 0 Not Useful 0