CVE-2026-16734 is a missing authorization vulnerability (CWE-862) in the Stripe Payment Forms by WP Full Pay WordPress plugin versions prior to 8.5.2. The plugin fails to verify that the caller owns the Stripe payment intent referenced in two unauthenticated payment-form AJAX actions. An unauthenticated attacker can exploit this by using a nonce embedded in public pages to change the amount of a payment intent. Although version 8.5.0 introduced an ownership check, it was only applied to one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions vulnerable to manipulation. The plugin then updates the payment intent server-side through the Stripe API using the store's secret key, potentially allowing unauthorized payment amount changes.

An unauthenticated attacker can manipulate the amount of a payment intent processed by the Stripe Payment Forms plugin, potentially causing incorrect payment amounts to be charged or processed. This could lead to financial loss or fraud for the store using the plugin. The vulnerability affects the integrity of payment processing by allowing unauthorized modification of payment details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 8.5.2 or later once available, as the description indicates fixes were made in that version. Until then, restrict access to payment form AJAX actions or disable the plugin if possible to prevent exploitation.