Skip to content
Sign in
6.8 Medium

CVE-2026-74991 The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form…

Description

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.

Affected products and versions

Product Affected versions Fixed in
WPForms 1.8 1.8.8.2 → < 2.0.2 2.0.2

Other CVEs of WPForms

The 5 CVEs of WPForms →
CVE-2026-84744 The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values… 6.5 Medium CVE-2026-4986 The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events… 5.3 Medium CVE-2024-11223 The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high… 4.7 Medium CVE-2024-7056 The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high… 3.5 Low
Track this CVE