CVE-2026-74991

Published: Set 24, 2026 Last Modified: Set 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.

284

Improper Access Control

Incomplete
Abstraction: Pillar Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
Technologies: Not Technology-Specific, ICS/OT, Web Based
View CWE Details
https://wpscan.com/vulnerability/e539d37e-91bb-4d79-b812-ac…
https://wpscan.com/vulnerability/e539d37e-91bb-4d79-b812-ac3c6c1a0f70/