122 matches found
CVE-2026-18467
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
CVE-2026-18467
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation in versions up to and including 5.0.3 . The root cause is a logic flaw where the pt_cf_checkout_meta() filter copies $_POST['pt_form_field'][*] keys into the payment meta array...
EUVD-2026-85777
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
CVE-2026-18467 Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...
WordPress Paytium: Mollie payment forms & donations plugin <= 5.0.3 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin Paytium versions = 5.0.3...
CVE-2025-22652
CVE-2025-22652 1️⃣ コンポーネントタイプ WordPress プラグイン 2️⃣ コンポーネント詳細 コンポーネント名 Payment Forms for Paystack 脆弱性のあるバージョン &orderby=&order=,+select+sleep5+from+dual+where+1=1 例えば、pff-paystack id="13"...
WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.5 - Cross-Customer Subscription Cancellation vulnerability
Cross-Customer Subscription Cancellation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Full Stripe Free versions 8.5.5...
CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...
CVE-2026-80311
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...
CVE-2026-80311: Authorization Bypass Through User-Controlled Key
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...
CVE-2026-77758
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...
EUVD-2026-66288
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...
CVE-2026-77758: Exposure of Sensitive Information to an Unauthorized Actor
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...
CVE-2026-77789: Authorization Bypass Through User-Controlled Key
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...
PT-2026-81968
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
CVE-2026-66444
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...
EUVD-2026-57869
Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...