The Accept Stripe Payments WordPress plugin before version 2.1.4 fails to verify that the product being fulfilled exactly matches the product for which a payment was actually made. Instead, it only checks that the amount paid is at least the price of the referenced product. This flaw allows an attacker who has completed a legitimate payment to obtain fulfillment for a different product of equal or lower price, effectively stealing goods without additional payment.

Any WordPress site running the Accept Stripe Payments plugin with a version earlier than 2.1.4 is affected. The plugin is a commercial WordPress add‑on, but the vendor name is listed as Unknown:Accept Stripe Payments in the CNA data. No user authentication is required to trigger the issue; the production environment simply lacks a check that the fulfillment request references the same product as the payment confirmation.

The lack of a public CVSS score or EPSS value makes the formal severity unclear, but the vulnerability can directly lead to financial loss and inventory misallocation. Because an attacker only needs to complete a genuine payment, the exploit requires no additional account access. The vulnerability is not listed in the CISA KEV catalog. The core weakness is an Insecure Direct Object Reference (IDOR) that permits unauthenticated substitution of protected resources. The risk of exploitation is significant if sites continue to run the affected plugin without applying the recommended patch.