The WPFormify plugin for WordPress is deficient in capability checks and nonce verification within its Stripe callback and disconnect functions. This oversight allows an unauthenticated user to influence the plugin’s settings by calling these functions through admin-post.php, writing new credential values or erasing existing ones. Consequently an attacker could reroute site payments to a malicious Stripe account or halt all Stripe processing altogether.

All WordPress installations using the WPFormify – Stripe Payments with Form and Checkout plugin version 1.1.1 or earlier are affected. The plugin is provided by the vendor saadiqbal and is typically added to sites that rely on Stripe for payments.

The vulnerability carries a CVSS score of 8.2, indicating high severity. While an EPSS score is not available, the attack scenario does not require privileged access and relies on the admin_init hook being reachable through admin-post.php without authentication. Because the flaw permits changing or removing payment credentials, the risk to commercial or nonprofit sites using Stripe is substantial. The endpoint is not listed in the CISA KEV catalog, but the potential impact warrants immediate attention.