PT-2026-49633 · Woocommerce · Woocommerce Stripe Payment Gateway

Dmitry Ignatyev

·

Published

2026-06-16

·

Updated

2026-06-16

·

CVE-2026-2381

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax pay for order() function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order key verification when processing payment for an order via the wc stripe pay for order WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2381

Affected Products

Woocommerce Stripe Payment Gateway