This vulnerability (CVE-2026-42752) affects Stripe Payments versions up to 2.0.98 and involves an unauthenticated bypass of expected behavior, categorized under CWE-440. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact includes limited confidentiality and integrity loss, with no availability impact. No vendor advisory or patch information is available at this time, and no known exploits are reported in the wild.

An unauthenticated attacker can bypass expected behavior controls in the affected Stripe Payments plugin versions, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or privilege escalation. The vulnerability could allow unauthorized access or manipulation of certain plugin functions or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the plugin or implementing compensating controls if feasible.