The WPForms WordPress plugin before version 2.0.2 contains a flaw that fails to confirm that a Stripe payment token supplied in a public form submission belongs to the site owner before processing withdrawals. This oversight allows any unauthenticated visitor to trigger a full refund and instantly cancel a subscription for payments created by other applications on the same Stripe account. The flaw is an improper authorization weakness, enabling attackers to compromise the financial integrity of the site without authentication.

Affecting the WPForms plugin developed by WPForms, this vulnerability applies to all installations running the plugin in versions 1.8.8.2 through 2.0.1.1, inclusive. Site owners who have not upgraded to version 2.0.2 or later are potentially exposed. No specific operating system or web server requirements are indicated; the issue exists regardless of hosting environment as long as the vulnerable plugin is active.

The vulnerability poses a moderate severity risk because it enables unauthenticated users to initiate financial transactions that reverse or revoke payments, potentially causing significant revenue loss and trust damage. The CVSS score of 6.8 reflects this moderate level of threat. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the issue is not listed in the CISA KEV catalog; however, the lack of authentication and the ease of exploitation via a standard web form indicate that attackers can leverage this flaw with minimal effort.