WordPress Plugin Vulnerabilities

Accept Stripe Payments < 2.0.99 - Unauthenticated Payment Bypass

Description

The Accept Stripe Payments plugin for WordPress is vulnerable to Payment Bypasses in all versions up to, and including, 2.0.98. This makes it possible for unauthenticated attackers to bypass payments.

Affects Plugins

Plugin icon
stripe-payments
Fixed in 2.0.99

References

CVE
CVE-2026-42752
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8b932141-5adc-4ec2-9b4f-c6ba610de1b9

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
82f8e261-6eaa-4e1f-be8f-b0c26ab37468

Timeline

Publicly Published
2026-05-29 (about 2 months ago)
Added
2026-06-02 (about 2 months ago)
Last Updated
2026-06-02 (about 2 months ago)

Other

Published
Title
Published
2021-09-22
Title
WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise
Published
2026-07-08
Title
GamiPress < 7.9.5 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
Published
2026-07-27
Title
Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR
Published
2026-02-26
Title
WP Recipe Maker < 10.3.3 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
Published
2026-08-19
Title
Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure