CVE-2026-74991

6.8 Moyenne

Publiée le 24/09/2026 à 08:17 · Modifiée le 24/09/2026 à 16:42 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.

Traduire en français

Produits concernés

Unknown WPForms

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-284

Références

https://wpscan.com/vulnerability/e539d37e-91bb-4d79-b812-ac3c6c1a0f70/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories