EUVD-2026-37059
GHSA-xpf8-p6c2-qcp9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network endpoint with publicly available nonce requires no authentication; impact is limited to order status corruption with no confidentiality exposure.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_pay_for_order() function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the wc_stripe_pay_for_order WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.
AnalysisAI
Unauthenticated order sabotage in WooCommerce Stripe Payment Gateway (all versions ≤10.7.0) allows any remote attacker to force pending WooCommerce orders into a 'failed' state without owning or authenticating against those orders. The root cause is a missing authorization check on the ajax_pay_for_order() function: the only gate is a nonce that is publicly available on any page where Express Checkout is enabled, providing no actual access control. Exploitation is trivially automatable via sequential order ID enumeration, enabling targeted disruption of an entire store's pending transactions. No public exploit has been identified at time of analysis, and no KEV listing exists, but the attack complexity is effectively zero for stores with Express Checkout active.
Technical ContextAI
The vulnerability exists in the WooCommerce Stripe Payment Gateway WordPress plugin (CPE: cpe:2.3:a:woocommerce:woocommerce_stripe_payment_gateway:*:*:*:*:*:*:*:*), specifically within the ajax_pay_for_order() method of the Express Checkout AJAX handler (class-wc-stripe-express-checkout-ajax-handler.php, confirmed at line 355 in the 10.3.1 tag). The function is exposed via the wc_stripe_pay_for_order WC-AJAX endpoint, WordPress/WooCommerce's unauthenticated AJAX dispatch system. CWE-862 (Missing Authorization) applies directly: the function performs a nonce check but omits both order ownership verification and order_key validation. Because the nonce is embedded in any WooCommerce storefront page where Express Checkout is rendered, it is publicly discoverable by any visitor - effectively neutralizing the nonce as a security control. Supplying a fake payment method ID triggers a Stripe payment exception in class-wc-gateway-stripe.php (line 523 in 10.3.1 tag), which WooCommerce's order state machine interprets as a payment failure and updates the order status to 'failed'. The WordPress Trac changeset between tags 10.7.0 and 10.8.0 indicates the fix was applied in the Express Checkout AJAX handler.
RemediationAI
Upgrade the WooCommerce Stripe Payment Gateway plugin to version 10.8.0 or later, as the WordPress Trac changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-gateway-stripe/tags/10.7.0&new_path=%2Fwoocommerce-gateway-stripe/tags/10.8.0) confirms the authorization fix was applied between the 10.7.0 and 10.8.0 tags. Update via the WordPress admin plugin dashboard or WP-CLI (wp plugin update woocommerce-gateway-stripe). As an interim compensating control for stores that cannot immediately patch, disabling the Express Checkout feature removes public nonce availability from the storefront, which eliminates the accessible attack path through the wc_stripe_pay_for_order endpoint - note that this trade-off disables Apple Pay, Google Pay, and Link payment buttons for customers, which may have conversion impact. Additionally, deploying a Web Application Firewall rule to block unauthenticated POST requests to /?wc-ajax=wc_stripe_pay_for_order can reduce exposure, though WAF rules should not substitute for patching. The authoritative Wordfence advisory is at https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3b52f7-e2c3-44f7-8e19-b6c51ccd50e0.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when up
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today