CVE-2026-6627 targets a WordPress plugin (wpf) that mishandles Stripe credential management by hooking two functions—wpf_stripe_callback_success() and wpf_stripe_disconnect()—to admin_init without any authentication, capability verification, or nonce validation. This is not a subtle bug; it's a structural failure where the developer assumed that being in the 'admin' context implies privilege. It does not. The admin_init hook fires on every admin page load AND on admin-post.php requests—the latter being publicly accessible endpoints that provide zero authentication on their own. That burden falls entirely on the developer, and WordPress provides no scaffold to guide them toward correct implementation.
The vulnerability becomes severe when you examine the attack vector. An attacker doesn't need to steal data—they need only a Stripe account (trivially obtained) and a single unauthenticated POST to admin-post.php with the appropriate action parameter. This injects attacker-controlled Stripe credentials into the site configuration. Once redirected, legitimate payments flow through the attacker's Stripe account. Critically, the attack is self-sustaining: after the credential redirect is in place, fraud continues automatically without the attacker maintaining access to the WordPress site. The plugin isn't just vulnerable—it becomes a running fraud engine hosted on your infrastructure.
Check your plugin directory for functions hooked to admin_init that modify settings, credentials, or state. If any lack current_user_can('manage_options') checks and wp_verify_nonce validation, they are exploitable. For webhook handlers intended to receive public requests, do not combine credential management in the same endpoint—separate webhook processing from administrative configuration. The WordPress Plugin Handbook documents the admin_init anti-pattern, but the knowledge hasn't reached the development workflow that produces version 1.1.1 payment plugins. That's an ecosystem failure, not an excuse, and it's producing this vulnerability class at scale.