WP Full Stripe Free is vulnerable because the wpfs_update_failed_payment_status AJAX handler performs no capability check, nonce verification, or logged‑in check. An unauthenticated attacker who knows a valid Stripe Payment Intent ID, which is exposed to the customer browser during checkout, can send a POST request to the endpoint, causing the plugin to mark a successful payment as failed and overwrite failure codes and messages with attacker‑supplied values. This results in unauthorized alteration of payment record integrity and can disrupt financial reporting or allow fraudulent behavior.

The issue affects the WordPress plugin "Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions" from themeisle, in all versions up to and including 8.4.3.

The CVSS score is 5.3, indicating moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an unauthenticated POST to the wpfs_update_failed_payment_status endpoint and a valid Payment Intent ID, which attackers can obtain from the browser. Because the endpoint is publicly accessible, exploitation is possible in a production environment unless mitigations are applied.