CVE-2026-6627: saadiqbal wpformify – stripe payments with form and checkout Missing Authorization

Vulnerability summary

CVE-2026-6627 is a high (CVSS 8.2) Missing Authorization vulnerability in saadiqbal wpformify – stripe payments with form and checkout. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.7% of scored vulnerabilities. Fixed in 1.1.2.

Timeline

1. 05-08-2026
   PublishedVulnerability first disclosed.
2. 05-08-2026
   Last modifiedVulnerability information updated.

Description

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.