EUVD-2026-36838
GHSA-q946-p8hr-8q7p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible WordPress plugin, no authentication required per description, limited data access and modification only, no availability or scope impact confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.
AnalysisAI
Unauthenticated bypass in the Stripe Payments WordPress plugin (versions up to and including 2.0.98) allows remote, unauthenticated attackers to circumvent authentication controls, resulting in limited confidentiality and integrity impact against affected WordPress installations. Reported by Patchstack (ENISA EUVD-2026-36838), the flaw is classified under CWE-440 (Expected Behavior Violation), indicating the plugin's actual enforcement diverges from its intended or documented security model. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
The affected product is the 'Stripe Payments' WordPress plugin developed by MRA13 / Team Tips and Tricks HQ, identified via CPE cpe:2.3:a:mra13_/_team_tips_and_tricks_hq:stripe_payments:*:*:*:*:*:*:*:*. This plugin integrates Stripe's payment gateway with WordPress sites, handling payment form submission and transaction processing. The root cause class is CWE-440 (Expected Behavior Violation), which specifically describes a scenario where a feature, API, or behavior does not function as the product's security documentation or intended design specifies. In the context of an authentication bypass, this means one or more plugin endpoints or AJAX actions that are documented or designed to require authentication or authorization verification fail to enforce those checks in practice, allowing unauthenticated HTTP requests to interact with protected functionality. This pattern is common in WordPress plugins that register wp_ajax_nopriv_ hooks inadvertently, or that rely on nonce-only checks without coupling them to capability verification.
RemediationAI
Update the Stripe Payments WordPress plugin to a version above 2.0.98 if a patched release has been issued by the vendor - consult the official WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/stripe-payments/vulnerability/wordpress-stripe-payments-plugin-2-0-98-bypass-vulnerability-vulnerability for the confirmed fix version, as an exact patched version number was not independently confirmed in the available intelligence data. If no patch is available or cannot be applied immediately, consider disabling the plugin until patched, which eliminates attack surface at the cost of losing Stripe payment functionality on the site. As a network-layer compensating control, restrict access to the WordPress admin and AJAX endpoints (wp-admin/, wp-login.php, admin-ajax.php) to trusted IP ranges using server configuration or a WAF rule, which limits unauthenticated attacker access at the cost of potentially blocking legitimate users if not carefully scoped. WordPress site hardening measures such as disabling XML-RPC and applying least-privilege user roles provide defense-in-depth but do not directly mitigate this bypass.
More in Stripe Payments
View allSame weakness CWE-440 – Expected Behavior Violation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today