CVE-2026-80311
Received Received - Intake

Subscription Cancellation in WP Full Pay WordPress Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: WPScan

Description
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers. Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-80311
EUVD
EUVD-2026-68060

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_full_pay stripe_payment_forms to 8.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5. It allows a user with a valid customer portal session to cancel subscriptions belonging to other customers without proper verification. The plugin fails to confirm that a subscription is linked to the customer associated with the active session.

Detection Guidance

To detect this vulnerability, check if your WordPress site is running the Stripe Payment Forms by WP Full Pay plugin version below 8.5.5. Use the WordPress admin dashboard or run a command like 'wp plugin list' in the site's root directory to verify the installed version.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to cancel subscriptions of other customers. This may lead to service disruptions, loss of access to paid services, or financial inconvenience for affected customers. The attacker needs to know the target subscription's identifier, which is high-entropy and not easily guessable.

Mitigation Strategies

Immediately update the Stripe Payment Forms by WP Full Pay plugin to version 8.5.5 or later. This version includes the fix for the IDOR vulnerability. If updating is not possible, consider disabling the plugin temporarily until an update can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80311. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart