CVE-2026-16734
Received Received - Intake

Unauthenticated Payment Intent Amount Manipulation in Stripe Payment Forms by WP Full Pay

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-16734
EUVD
EUVD-2026-53725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_full_pay stripe_payment_forms to 8.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.2 allows unauthenticated users to change the amount of a Stripe payment intent. The plugin fails to verify ownership of payment intents in two AJAX actions, despite a partial fix in version 8.5.0 that only protected one handler.

Detection Guidance

Check the installed version of the Stripe Payment Forms by WP Full Pay plugin. If it is below 8.5.2, the vulnerability is likely present. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker could exploit this to alter payment amounts, potentially leading to financial losses or fraudulent transactions. Since the plugin updates payment intents server-side using the store's secret key, unauthorized changes could go unnoticed until after the transaction is processed.

Compliance Impact

This vulnerability could lead to non-compliance with financial regulations and data protection laws like GDPR or HIPAA by enabling unauthorized transactions. It may result in improper handling of payment data and financial discrepancies, violating integrity and security requirements.

Mitigation Strategies

Update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.2 or later immediately. This version includes the necessary ownership verification for payment intents to prevent unauthorized amount changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart