CVE-2026-12432 is a missing authorization vulnerability (CWE-862) in the WP Full Stripe Free plugin for WordPress, specifically in the wpfs_update_failed_payment_status AJAX handler. This handler is accessible via both authenticated and unauthenticated AJAX hooks (wp_ajax_ and wp_ajax_nopriv_) and does not perform any capability checks, nonce verification, or logged-in user validation before updating payment records in the database. Attackers with a valid Stripe Payment Intent ID, which is exposed to customers during normal Stripe.js checkout flows, can exploit this to modify payment statuses and failure details, potentially disrupting payment record integrity. The vulnerability affects versions up to and including 8.4.3. No official patch or remediation level has been provided as of the published date.

The vulnerability allows unauthenticated attackers to alter payment records in the affected WordPress plugin's database by marking successful payments as failed and injecting arbitrary failure codes and messages. This compromises the integrity of payment data but does not disclose sensitive information or cause availability impact. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint if possible, and monitor for suspicious activity related to payment status updates. Avoid exposing valid Stripe Payment Intent IDs unnecessarily. Follow vendor communications for updates on patches or official mitigations.