The vulnerability allows an unauthenticated visitor to modify the amount field of a Stripe payment intent through two AJAX actions in the WP Full Pay plugin. The plugin fails to verify ownership of the payment intent, relying only on a nonce that is embedded on public pages. By altering the amount and sending the request to the server, the plugin uses the store’s secret key to update the intent directly via Stripe’s API, resulting in fraudulent charges or incorrect billing. This represents a weakness due to missing role‑based access control (CWE-862).

Any WordPress site that uses the Stripe Payment Forms by WP Full Pay plugin version earlier than 8.5.2 is affected. The issue exists across all installations of that plugin where the pre‑8.5.2 version is deployed, regardless of site configuration.

Risk and exploitability: The vulnerability yields a CVSS score of 7.5, indicating high severity. The flaw permits financial manipulation without authentication. An attacker can send a crafted request to an AJAX endpoint that includes a nonce embedded in public pages, override the payment‑intent amount, and trigger the plugin to use the store's secret key to update the intent in Stripe. The EPSS score indicates a probability of exploitation of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the potential for revenue loss and customer trust damage warrants urgent attention.