Payload Ecommerce has an order confirmation validation issue

Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: - You use @payloadcms/plugin-ecommerce with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. Patche...

CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850

The Payload headless content management system is vulnerable in @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34 . When using the Stripe payment adapter , certain conditions can cause a Stripe order confirmation to be processed more than once. This is...

EUVD-2026-93493

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

EUVD-2026-88101

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...

CVE-2026-89411: Insufficient Verification of Data Authenticity

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it...

CVE-2026-74991

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

EUVD-2026-85794

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

CVE-2026-74991: Improper Access Control

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

PT-2026-96658

Name of the Vulnerable Software and Affected Versions Handily plugin for WordPress versions prior to 1.0.4 Description Missing authorization checks allow unauthenticated attackers to modify Stripe payment configuration settings. By manipulating payment settings parameters, an attacker can change...

WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.5 - Cross-Customer Subscription Cancellation vulnerability

Cross-Customer Subscription Cancellation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Full Stripe Free versions 8.5.5...

CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin, in versions before 8.5.5 , is vulnerable to a cross-customer subscription cancellation via an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a subscription belongs to the customer associated with the active custome...

CVE-2026-80311: Authorization Bypass Through User-Controlled Key

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-77758

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

EUVD-2026-66288

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.1 - Cross-Customer Subscription Modification vulnerability

Cross-Customer Subscription Modification vulnerability discovered by Charles Vosburgh in WordPress Plugin WP Full Stripe Free versions 8.5.1...

CVE-2026-77789 Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...

CVE-2026-77758: Exposure of Sensitive Information to an Unauthorized Actor

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...

CVE-2026-77789: Authorization Bypass Through User-Controlled Key

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...