CVE-2026-16734

HighCVSS 7.5/10Last modified Aug 26, 2026

Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-167355.3A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of th CVE-2026-167367.5The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing CVE-2026-167375.3The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied bookin CVE-2026-167385.3The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications CVE-2026-167395.9The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the CVE-2026-16746.5The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to una CVE-2026-167409.8Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense CVE-2026-167419.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP CVE-2026-167426.7systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user CVE-2026-167435.5A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validati CVE-2026-167458.8A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious CVE-2026-167462.7The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API