CVE-2026-6627 describes a missing authorization vulnerability (CWE-862) in the WPFormify – Stripe Payments with Form and Checkout plugin for WordPress, affecting all versions up to and including 1.1.1. The vulnerability arises because the functions `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()`, which handle Stripe payment credential updates and disconnections, lack proper capability checks and nonce verification. These functions are hooked to the `admin_init` action, which is triggered on `admin-post.php`, a URL accessible without authentication. As a result, unauthenticated attackers can overwrite the site's Stripe API credentials with attacker-controlled values or delete the stored credentials, potentially redirecting payments or disabling Stripe payment functionality.

The vulnerability allows unauthenticated attackers to modify or delete Stripe payment credentials used by the site. This can lead to payments being redirected to attacker-controlled Stripe accounts, causing financial loss or fraud. Additionally, attackers can disconnect the Stripe integration entirely, disrupting payment processing on the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to `admin-post.php` where possible and monitor for suspicious activity related to Stripe credential changes. Avoid exposing the plugin's admin endpoints to unauthenticated users.