CVE-2026-6627

Executive Summary

CVE-2026-6627 is a critical missing authorization vulnerability in the WPFormify – Stripe Payments with Form and Checkout plugin for WordPress, affecting all versions up to and including 1.1.1. The flaw allows unauthenticated attackers to overwrite or delete the site's Stripe API credentials, enabling payment redirection to attacker-controlled Stripe accounts or complete disruption of the payment integration. With a CVSS score of 8.2 (High) and no authentication required, this vulnerability poses an immediate financial and operational threat to any WordPress site processing payments through WPFormify.

Technical Analysis

Vulnerability Mechanism

The root cause of CVE-2026-6627 lies in two improperly secured functions within WPFormify:

1. wpf_stripe_callback_success() — Handles the Stripe OAuth callback success flow and updates stored Stripe credentials.
2. wpf_stripe_disconnect() — Disconnects the Stripe integration by deleting stored credentials.

Both functions are registered as WordPress AJAX-style hooks on the admin_init action. The critical flaws are:

• Missing capability checks — Neither function verifies that the requesting user has manage_options (administrator) privileges or any other capability requirement.
• Missing nonce verification — Neither function validates a WordPress nonce (security token), which means WordPress's built-in CSRF protection is completely bypassed.

The admin_init hook fires on every admin page request, but more importantly, it also fires when admin-post.php is accessed. The function admin_register_scripts() in WordPress explicitly notes: "admin-post.php is accessible without authentication." This means an attacker does not need to be logged in at all, nor do they need to send any cookies or session tokens.

Attack Surface

The attack surface is broad:

• Network accessibility: Any internet-facing WordPress site with WPFormify installed and active is reachable via HTTP/HTTPS.
• No authentication barrier: The vulnerable endpoints require no user authentication, no CSRF token, and no session state.
• Direct HTTP request triggering: The attacker crafts a simple HTTP GET or POST request to wp-admin/admin-post.php with the appropriate action parameter.

Code-Level Analysis

The vulnerable code is conceptually analogous to:

add_action('admin_init', 'wpf_stripe_callback_success');
add_action('admin_init', 'wpf_stripe_disconnect');

function wpf_stripe_callback_success() {
    // No current_user_can() check
    // No check_admin_referer() or wp_verify_nonce()
    
    if (isset($_GET['stripe_success'])) {
        $stripe_creds = array(
            'publishable_key' => sanitize_text_field($_GET['pk']),
            'secret_key'      => sanitize_text_field($_GET['sk'])
        );
        update_option('wpf_stripe_credentials', $stripe_creds);
    }
}

function wpf_stripe_disconnect() {
    // No capability or nonce check
    if (isset($_GET['wpf_stripe_disconnect'])) {
        delete_option('wpf_stripe_credentials');
    }
}

Exploitation Scenarios

Attack Chain: Stripe Payment Redirection

Step 1 — Reconnaissance: The attacker identifies WordPress sites running WPFormify. Detection vectors include:

• Checking for wp-content/plugins/wpformify/ in page source or error messages.
• Probing for the plugin's known static assets (CSS/JS files) under /wp-content/plugins/wpformify/assets/.
• Using WordPress fingerprinting tools or search engines for site URLs containing the plugin slug.

Step 2 — Weaponization — Credential Overwrite: The attacker first creates a Stripe account and obtains their own Stripe API keys (publishable and secret). They then craft the following HTTP request:

GET /wp-admin/admin-post.php?wpf_stripe_success=1&pk=pk_live_attackerPublishableKey&sk=sk_live_attackerSecretKey HTTP/1.1
Host: victim-wordpress-site.com

The request triggers wpf_stripe_callback_success() which reads the pk and sk parameters and stores them via update_option('wpf_stripe_credentials', ...). No nonce, no authentication, no referrer check.

Step 3 — Verification & Post-Exploitation:

• The attacker waits for the next payment transaction on the victim site.
• Customer payment forms now process through the attacker's Stripe account.
• The attacker observes incoming charges and collects funds.
• The victim is unaware until a customer reports payment failure or unusual transaction records.

Attack Chain: Stripe Integration Disconnection (DoS)

Step 1 — Reconnaissance: Same as above; identify WPFormify-enabled sites.

Step 2 — Weaponization — Deletion: The attacker crafts:

GET /wp-admin/admin-post.php?wpf_stripe_disconnect=1 HTTP/1.1
Host: victim-wordpress-site.com

This triggers wpf_stripe_disconnect() which calls delete_option('wpf_stripe_credentials'), completely removing stored Stripe credentials.

Step 3 — Post-Exploitation:

• The victim site's payment processing fails entirely — customers cannot complete checkouts.
• Revenue loss, customer trust degradation, and administrative overhead to reconfigure Stripe integration.
• The response is client-visible (error on checkout pages), making this a denial-of-service vector.

Impact Assessment

Business Impact

Affected Systems

• All WordPress installations with WPFormify version ≤ 1.1.1 active.
• Sites processing e-commerce transactions, donations, subscriptions, or fee collection.
• Multi-site WordPress deployments where the plugin is network-activated.

Blast Radius

• Financial: Direct theft of payment revenue; fraudulent transactions processed under the attacker's account.
• Operational: Payment downtime until administrator reconnects legitimate Stripe credentials.
• Reputational: Customers may report failed payments, damaging trust in the site's security posture.
• Compliance: PCI DSS considerations if payment data handling is disrupted; potential breach reporting obligations.

Detection Guidance

Sigma Rule

title: WPFormify Stripe Credential Manipulation Attempt
id: 872a94c7-6d8a-4b1a-bf3a-9a2e5f0c9d11
status: experimental
description: Detects unauthenticated attempts to overwrite or delete Stripe credentials via WPFormify admin-post.php endpoints
author: Valters IT Security Research
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection_url:
    cs-method: 'GET'
    cs-uri-stem:
      - '/wp-admin/admin-post.php'
    cs-uri-query|contains|all:
      - 'wpf_stripe_success'
      - 'pk='
      - 'sk='
  selection_disconnect:
    cs-method: 'GET'
    cs-uri-stem:
      - '/wp-admin/admin-post.php'
    cs-uri-query|contains:
      - 'wpf_stripe_disconnect'
  condition: selection_url or selection_disconnect
level: high
falsepositives:
  - Legitimate Stripe OAuth callback (should originate from Stripe IP ranges only)
  - Administrator reconnecting Stripe (should include wp-admin session cookie)
tags:
  - attack.credential_access
  - attack.impact
  - cve.2026.6627

YARA Rule

rule WPFormify_Stripe_Credential_Exfil
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP requests targeting WPFormify Stripe credential manipulation"
        reference = "CVE-2026-6627"
        date = "2026-01-15"
        severity = "high"
    strings:
        $endpoint1 = "wpf_stripe_success"
        $endpoint2 = "wpf_stripe_disconnect"
        $param_pk = /pk=(pk_)[a-zA-Z0-9_]{10,}/ nocase
        $param_sk = /sk=(sk_)[a-zA-Z0-9_]{10,}/ nocase
        $admin_post = "admin-post.php"
        $wp_prefix = "/wp-content/plugins/wpformify/"
    condition:
        filesize < 4KB and
        $admin_post and
        ($endpoint1 or $endpoint2) and
        ($param_pk or not ($endpoint1)) and
        ($wp_prefix or filesize < 2KB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-6627 WPFormify Stripe Credential Overwrite Attempt"; flow:established,to_server; http.uri; content:"admin-post.php"; nocase; pcre:"/wpf_stripe_success=/i"; pcre:"/pk=(pk_)[a-zA-Z0-9_]{10,}/i"; pcre:"/sk=(sk_)[a-zA-Z0-9_]{10,}/i"; sid:20266627; rev:1; priority:1; reference:cve,2026-6627;)

alert http any any -> any any (msg:"CVE-2026-6627 WPFormify Stripe Credential Disconnect Attempt"; flow:established,to_server; http.uri; content:"admin-post.php"; nocase; pcre:"/wpf_stripe_disconnect=/i"; sid:20266628; rev:1; priority:1; reference:cve,2026-6627;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where dns.question.name matches "*.wordpress.*" or 
    http.request.referrer == "wp-admin/admin-post.php" ]
  [ http where 
      http.request.uri.path == "/wp-admin/admin-post.php" and
      (
        wildcard(http.request.uri.query, "*wpf_stripe_success*") or
        wildcard(http.request.uri.query, "*wpf_stripe_disconnect*")
      ) and
      not http.request.headers.user_agent contains "Stripe"
  ]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/wp-admin/admin-post.php"
| where 
    (uri_query LIKE "%wpf_stripe_success%" 
     AND uri_query LIKE "%pk=%" 
     AND uri_query LIKE "%sk=%") 
  OR uri_query LIKE "%wpf_stripe_disconnect%"
| eval attack_type = case(
    uri_query LIKE "%wpf_stripe_success%" AND uri_query LIKE "%pk=%" AND uri_query LIKE "%sk=%", "credential_overwrite",
    uri_query LIKE "%wpf_stripe_disconnect%", "credential_disconnect",
    true(), "unknown"
  )
| table _time src_ip user_agent uri_path uri_query attack_type
| sort -_time
| stats count by src_ip attack_type
| where count > 3

Wazuh OSSEC Rule

<group name="web,CVE-2026-6627,">
  <rule id="100251" level="12">
    <if_sid>31122</if_sid>
    <field name="url">\.php</field>
    <regex>wpf_stripe_success|wpf_stripe_disconnect</regex>
    <regex>pk=|sk=</regex>
    <description>WPFormify CVE-2026-6627: Unauthenticated Stripe credential manipulation attempt detected</description>
    <group>cve-2026-6627,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source) — As of this report, no patched version of WPFormify has been released. The developer has not published a fixed version, advisory, or commit addressing these missing authorization checks.

1) Immediate Mitigations (Until Patch Available)

2) Patch/Upgrade Steps

• Check for updates daily — Monitor the WordPress plugin repository page for WPFormify.
• Subscribe to vendor notifications — Sign up on the plugin's official update channel.
• When patched version releases, upgrade immediately to version ≥ 1.1.2 (or the fixed version number).
• After updating, verify the wpf_stripe_callback_success() and wpf_stripe_disconnect() functions now include:
  • current_user_can('manage_options') capability check.
  • check_admin_referer() or equivalent nonce verification.

3) Long-Term Hardening

• Principle of least privilege: Ensure admin-post.php endpoints are not accessible from the public internet if not needed. Use a reverse proxy rule to block external access to /wp-admin/admin-post.php except for known legitimate actions.
• Vulnerability scanning: Integrate this CVE into your regular WordPress vulnerability scanning (e.g., WPScan, Wordfence CLI).
• Web server monitoring: Enable detailed access logging on WordPress admin endpoints and alert on anomalous access patterns.
• Payment security review: Conduct a PCI DSS-aligned review of all payment plugin configurations.
• Replace plugin if no patch arrives: Given the critical nature and zero patch confidence, consider migrating to a maintained Stripe payment plugin (e.g., WooCommerce Stripe Gateway) if WPFormify remains unpatched within 30 days.

References

1. NVD Entry — CVE-2026-6627: https://nvd.nist.gov/vuln/detail/CVE-2026-6627
2. WordPress Plugin Repository — WPFormify: https://wordpress.org/plugins/wpformify/
3. Wordfence Intelligence — CVE-2026-6627 analysis (if available at time of reading)
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html

Threat actor campaigns: No known active campaigns or exploit-in-the-wild evidence associated with CVE-2026-6627 at the time of this report. The EPSS score of 0.00616 (46.1% percentile) suggests moderate exploitation likelihood. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog.