The Restrict Content plugin for WordPress exhibits a missing authentication flaw in the rcp_stripe_create_setup_intent_for_saved_card function, allowing any user to call the function without sufficient capability checks. This leads to the exposure of Stripe SetupIntent client_secret values for any membership, revealing sensitive payment data that could be used for fraudulent activities or unauthorized access to billing information. The weakness is classified as CWE‑639, which describes misuse of input leading to authorization bypass or information disclosure.

All installations of the StellarWP Restrict Content plugin on WordPress sites running version 3.2.16 or earlier are vulnerable. The issue is present in every build up to and including 3.2.16, regardless of other site or plugin configurations.

The CVSS score of 8.2 indicates a high severity, and the EPSS score of less than 1% suggests a low probability of immediate exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying that known current exploits are not documented. Exploitation requires no authentication; an attacker can simply make an HTTP request to an endpoint that triggers the vulnerable function and retrieve the client_secret. Because the impact is the disclosure of payment credentials, any breach could lead to financial loss or regulatory penalties.