CVE-2026-16734 describes a missing authorization vulnerability (CWE-862) in the Stripe Payment Forms by WP Full Pay WordPress plugin versions prior to 8.5.2. The plugin fails to verify that the caller owns the Stripe payment intent referenced in two unauthenticated AJAX actions related to payment forms. An attacker can exploit this by using a nonce embedded in public pages to change the payment amount server-side via the Stripe API using the store's secret key. Although version 8.5.0 introduced an ownership check, it was only applied to one payment-intent handler, leaving other handlers vulnerable until fixed in 8.5.2.

An unauthenticated attacker can manipulate the amount of a payment intent processed by the Stripe Payment Forms plugin, potentially causing incorrect payment amounts to be charged or processed. This impacts the integrity of payment transactions but does not disclose sensitive data or cause denial of service. The vulnerability allows unauthorized modification of payment intent amounts via the Stripe API using the store's secret key.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in version 8.5.2 by applying proper ownership checks to all relevant payment-intent handlers. Until patched, restrict access to payment form AJAX actions or disable the plugin to prevent exploitation.