CVE-2026-77789

The Stripe Payment Forms by WP Full Pay WordPress plugin (versions before 8.5.1 ) is vulnerable to a Cross-Customer Subscription Modification flaw due to an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a subscription actually belongs to the customer associated with the ...