cve-2026-9618-Patch

$message , $status ; / Verify an AJAX nonce. @param string $action Nonce action. @return void / function peachpaystripeverifyajaxnonce $action if ! isset $POST'security' || ! isstring $POST'security' peachpaystripeajaxerror 'Invalid security token. Refresh the page and try again.', 403 ; $nonce =...

memscan

memscan Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a process's memory space Memory/Process Scanner Written by Matt Lewis, NCC Group 2014 Updated by Tom Watson, NCC Group 2015 Thanks to Jesse Bullock for lots of great ideas Released as open source by NCC Gro...

SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...

New API < v0.12.10 - Stripe Webhook Bypass

New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...

WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update

Bookit WordPress plugin 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication. id: CVE-2025-12841 info: name: WordPress...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...

lago-stripe-invoice-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-stripe-invoice-idor Write-up: https://abraxaslabs.tech/research/lago-stripe-invoice-idor lago-stripe-invoice-idor Lago v1.53.0 - GetLago POST /webhooks/stripe/:organizationid verifies Stripe-Signature with that...

nextjs-supabase-stripe-security-checker

nextjs-supabase-stripe-security-checker Free, local security scan for Next.js + Supabase + Stripe apps: leaked keys, missing RLS and grants, unsafe Stripe webhooks. Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? One...

CVE-2026-111597

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111597

The Forminator Forms WordPress plugin, in versions prior to 1.58.4 , is vulnerable to an unauthenticated disclosure of information. The root cause is that the plugin fails to verify if a Stripe Checkout payment has been completed before returning the after-payment response for a pending submissio...

CVE-2026-111597 Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe Checkout Session

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111579 Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

EUVD-2026-123164

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111579

The Forminator Forms WordPress plugin (versions before 1.58.4 ) is vulnerable to an unauthenticated privilege escalation because it fails to enforce payments on the server side when a configured payment gateway is unavailable. If a gateway was previously connected and is subsequently disconnected...

PT-2026-144995

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111597: Unknown Forminator Forms: The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before…

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-123145

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the...

CVE-2026-123145 WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the...

CVE-2026-123145

The WooCommerce Stripe Payment Gateway WordPress plugin (versions before 11.1.0 ) contains a vulnerability where account passwords are stored in plaintext within the database. This occurs because the plugin fails to exclude account passwords from the checkout fields saved to order metadata during...

WordPress WooCommerce Stripe Payment Gateway plugin < 11.1.0 - Customer Password Stored in Plaintext vulnerability

Customer Password Stored in Plaintext vulnerability discovered by Francesco Carlucci in WordPress Plugin WooCommerce Stripe Payment Gateway versions 11.1.0...