What is GHSA-wq46-399w-9f66?

GHSA-wq46-399w-9f66 is a security advisory published by GitHub Security Advisories with Medium severity. The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a...

Which CVE IDs does GHSA-wq46-399w-9f66 cover?

GHSA-wq46-399w-9f66 covers the following CVE IDs: CVE-2026-77789. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wq46-399w-9f66?

GHSA-wq46-399w-9f66 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-wq46-399w-9f66MediumCVSS 4.3

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a...

Vendor

GitHub Security Advisories

Published

August 26, 2026

Last Modified

August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-77789 →

📋 Description

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-77789
https://wpscan.com/vulnerability/b467131b-15e1-4d1e-9a6a-3ee6e8bd3722
https://github.com/advisories/GHSA-wq46-399w-9f66