WooCommerce Stripe Gateway CVE-2026-45217

The vulnerability is present when the ThemeHigh Stripe Payment Gateway for WooCommerce plugin is installed and active on a WordPress site running version 5.0.7 or earlier, and the plugin's password recovery or account authentication functionality is reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special configuration, authentication, or user interaction is required - the flaw is exploitable against default plugin installations with network access to the WordPress site. Exploitation is limited to the integrity and availability impact classes (no confidentiality breach per CVSS:C:N), and is bounded by the plugin being installed and active. Sites that have disabled or do not use the plugin's account recovery features may reduce but not eliminate exposure without a patch, as the attack path has not been fully detailed in public disclosures.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) indicates a fully unauthenticated, network-accessible attack requiring no user interaction and no special privileges, which is a significant concern for a widely-deployed WooCommerce payment plugin. However, impact is bounded - scope is unchanged, confidentiality impact is none, with only partial integrity and availability degradation. EPSS at 0.05% (16th percentile) reflects very low observed exploitation probability in the wild, and SSVC confirms exploitation status as 'none' with only partial technical impact. The attack IS rated automatable by SSVC, meaning mass scanning and automated exploitation attempts are feasible if a PoC emerges. There is no CISA KEV listing and no known public exploit at time of analysis. The combination of high accessibility (no auth, no complexity) with low real-world exploitation probability suggests this is a real but currently low-priority issue - elevated primarily by the automatable nature and the sensitive payment-processing context of the plugin.

An unauthenticated attacker identifies a WordPress e-commerce site running ThemeHigh Stripe Payment Gateway for WooCommerce version 5.0.7 or earlier. The attacker submits a crafted password recovery request that exploits the alternate authentication path - bypassing normal credential validation - to trigger a successful account recovery flow for a targeted user account, potentially a shop administrator. Because the attack requires no privileges and low complexity, it is suitable for automated targeting across large numbers of WordPress sites, though no public exploit code has been identified at time of analysis.