An unauthorized access vulnerability in the WPFormify plugin for WordPress allows unauthenticated attackers to modify or delete sensitive Stripe payment configuration data.

The vulnerability stems from missing authorization checks within the module responsible for Stripe payment settings. This allows an unauthenticated attacker to interact with sensitive administrative functions, specifically modifying or removing payment credentials.

Exploitation of this vulnerability could lead to significant financial disruption, as attackers could redirect payment processing or cause a denial of service for e-commerce transactions. With a CVSS score of 8.2, this vulnerability represents a high risk to the financial integrity and reputation of organizations relying on this plugin for checkout operations.

Immediate Action: Update the WPFormify plugin to version 1.1.2 or the latest available version to address the missing authorization logic.

Proactive Monitoring: Audit logs for unauthorized changes to payment gateway configurations or unexpected database interactions related to the Stripe module.

Compensating Controls: Ensure administrative access to the WordPress dashboard is strictly limited and protected by multi-factor authentication, and utilize a WAF to filter malicious requests targeting plugin-specific modules.

Public Exploit Available: Unknown

Organizations using WPFormify should prioritize updating to the latest version to prevent potential unauthorized manipulation of payment settings. Given the direct impact on financial operations, ensure that all payment gateway configurations are audited for integrity following the update.