Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Unauthenticated reCAPTCHA Bypass via Inline Payment Forms
- ID
- WPSEC-2026-0125
- Plugin
- Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions (wp-full-stripe-free)
- Affected
- all versions before 8.5.7
- Remediation
- Update to 8.5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions on WPSec AttackSurface
- Fix released
- Published
Description
The Stripe Payment Forms by WP Full Pay plugin for WordPress is vulnerable to a reCAPTCHA bypass on inline forms in all versions up to, and including, 8.5.6. The unauthenticated AJAX action wp_get_Setup_Intent_Client_Secret, which creates a Stripe SetupIntent or PaymentIntent and returns its client secret, skipped reCAPTCHA validation for inline payment forms (the validator exempted that action) and ignored captcha errors for every inline form type except donations, while on donation forms a nonce issued after one solved captcha could be replayed for up to 10 minutes. This makes it possible for unauthenticated attackers to obtain Stripe intent client secrets in bulk without solving the captcha on sites that have enabled reCAPTCHA for inline forms, which can facilitate card-testing abuse against the merchant's Stripe account.
References
- https://wpsec.com/vuln/WPSEC-2026-0125/
- https://plugins.svn.wordpress.org/wp-full-stripe-free/tags/8.5.7/
- https://wordpress.org/plugins/wp-full-stripe-free/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS