This vulnerability (CVE-2026-42378) in Themeisle's WP Full Stripe Free plugin (versions <= 8.4.1) is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. It enables an attacker with low privileges to bypass subscriber authentication mechanisms, potentially gaining unauthorized access. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no user interaction, and high confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with low privileges can bypass subscriber authentication controls, leading to unauthorized access to subscriber-level functionality or data. The confidentiality of subscriber information is at risk, but integrity and availability are not impacted according to the CVSS vector. This could allow unauthorized viewing or use of subscriber features without proper authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin or disabling it if feasible. Monitor vendor channels for updates and apply patches promptly once available.