This vulnerability (CVE-2026-42378) in WP Full Stripe Free (<=8.4.1) is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. It allows an attacker with low privileges to bypass authentication controls without user interaction, potentially exposing sensitive data. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No vendor advisory or patch information is currently provided.

Successful exploitation could allow an attacker with limited privileges to bypass authentication controls, leading to unauthorized access to sensitive information. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from Themeisle and consider restricting access to affected plugin functionality as a temporary measure.