6.8
Moyenne
CVE-2026-74991 The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form…
Description
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPForms 1.8 | 1.8.8.2 → < 2.0.2 | 2.0.2 |
Autres CVE de WPForms
Les 5 CVE de WPForms →
CVE-2026-84744
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values…
6.5
Moyenne
CVE-2026-4986
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events…
5.3
Moyenne
CVE-2024-11223
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high…
4.7
Moyenne
CVE-2024-7056
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high…
3.5
Faible