CVE-2026-12432 describes a missing authorization vulnerability (CWE-862) in the WP Full Stripe Free plugin for WordPress, specifically in the wpfs_update_failed_payment_status AJAX handler. This handler is accessible via both authenticated and unauthenticated AJAX hooks (wp_ajax_ and wp_ajax_nopriv_) and does not perform any capability checks, nonce verification, or logged-in user validation before updating payment records in the database. An attacker with a valid Stripe Payment Intent ID, which is exposed to customers during normal Stripe.js checkout flows, can exploit this to alter payment statuses and failure messages arbitrarily.

An unauthenticated attacker can manipulate payment records by marking previously successful payments as failed and injecting arbitrary failure codes and messages. This impacts the integrity of payment data but does not disclose sensitive information or cause denial of service. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, no confidentiality or availability impact, and limited integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint if possible or implement custom authorization checks. Monitor for updates from the vendor themeisle regarding a security patch or official fix.