CVE-2026-6627 Details
Description
The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.
A vulnerability exists in the WPFormify – Stripe Payments with Form and Checkout plugin for WordPress, in all versions through 1.1.1. The issue allows unauthorized modification and deletion of Stripe payment credentials. This vulnerability arises from a lack of proper capability checks and nonce verification in the 'wpf_stripe_callback_success()' and 'wpf_stripe_disconnect()' functions, which are both triggered by the 'admin_init' hook. The 'admin_init' hook activates on 'admin-post.php', a file accessible without authentication. As a result, unauthenticated attackers can replace the site's Stripe API credentials with their own, redirecting payments to their Stripe account, or completely disconnect the Stripe integration by removing the stored credentials.
Users are advised to update the WPFormify Stripe Payments plugin to version 1.1.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WPFormify | <= 1.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |