WP Full Pay < 8.5.1 Unauth Sensitive Data Disclosure via Unconfirmed Session (CVE-2026-77758)

Vulnerability Overview Vulnerability Name: Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session Description: The plugin fails to properly verify whether the customer portal session has completed the confirmation step, allowing unauthenticated users to read subscription and billing information of other customers. CVE ID: CVE-2026-77758 Classification: - Type: SENSITIVE DATA DISCLOSURE - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 5.3 (Medium) Affected Versions Affected Plugin: wp-full-stripe-free Fixed Version: 8.5.1 Remediation Fixed Version: Upgrade to version 8.5.1 or later. Timeline Public Disclosure Date: 2026-08-24 Added Date: 2026-08-24 Last Updated: 2026-08-24 Additional Information Original Researcher: Vaibhav Narkhede Submitter: Vaibhav Narkhede Verification Status: Yes WPVDB ID: 2d4fc012-9f80-43cc-b88d-96842700fe2f References CVE: CVE-2026-77758 Related Vulnerabilities Order Delivery Date Pro for WooCommerce < 12.6.0: Unauthenticated Arbitrary Post Title Disclosure Add Admin CSS < 2.5: Unauthenticated Full Path Disclosure Hash Elements < 1.5.5: Authenticated (Contributor+) Information Exposure Essential Addons for Elementor < 5.9.14: Unauthenticated Private/Draft Posts Access Sky Addons for Elementor < 2.6.2: Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template Summary This vulnerability involves unauthorized users reading other customers' sensitive data through unconfirmed customer portal sessions. It is recommended to upgrade to the fixed version 8.5.1 as soon as possible to address this issue.

Goal Reached Thanks to every supporter — we hit 100%!

WP Full Pay < 8.5.1 Unauth Sensitive Data Disclosure via Unconfirmed Session (CVE-2026-77758)

More from this source