CVE-2026-6627 is a missing authorization vulnerability (CWE-862) in the WPFormify – Stripe Payments with Form and Checkout WordPress plugin affecting all versions up to and including 1.1.1. The issue stems from the lack of capability checks and nonce verification in the wpf_stripe_callback_success() and wpf_stripe_disconnect() functions, both hooked to admin_init. Since admin_init is triggered on admin-post.php, which is accessible without authentication, unauthenticated attackers can invoke these functions to overwrite the site's Stripe API credentials with attacker-controlled values or disconnect the Stripe integration by deleting stored credentials. This can result in payments being redirected to the attacker’s Stripe account or loss of payment functionality.

An unauthenticated attacker can overwrite the Stripe API credentials used by the site, redirecting payments to their own Stripe account, causing financial loss or fraud. Alternatively, the attacker can delete the stored Stripe credentials, disrupting payment processing on the site. The vulnerability does not impact confidentiality but has a high integrity impact and a low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to admin-post.php and monitor for suspicious requests targeting the vulnerable plugin endpoints. Applying capability checks and nonce verification in the affected functions is necessary to prevent unauthorized access.