CVE-2026-81424: CWE-639 Authorization Bypass Through User-Controlled Key in Accept Stripe Payments

CVE-2026-81424 is an authorization bypass vulnerability (CWE-639) in the Accept Stripe Payments WordPress plugin prior to version 2.1.4. The flaw arises because the plugin verifies only that the payment amount is at least the price of the referenced product, without confirming that the product fulfilled matches the product paid for. This enables unauthenticated attackers who complete a legitimate payment to obtain fulfillment for a different product of equal or lower price than the one paid, potentially leading to unintended product delivery.

The vulnerability allows attackers to bypass proper authorization checks and receive fulfillment for products they did not pay for, as long as the payment amount meets or exceeds the price of the product they receive. This can lead to financial loss or inventory misallocation for merchants using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 2.1.4, upgrading to version 2.1.4 or later is recommended once a fix is confirmed. Until then, merchants should monitor for updates from the plugin vendor and avoid using vulnerable versions.