CVE-2026-77758
Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session
Description
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
INFO
Published Date :
Aug. 26, 2026, 6 a.m.
Last Modified :
Aug. 26, 2026, 6 a.m.
Remotely Exploit :
No
Source :
WPScan
Affected Products
The following products are affected by CVE-2026-77758
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update WP Full Pay plugin to version 8.5.1 or later.
- Verify customer session confirmation step is enforced.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-77758 vulnerability anywhere in the article.