EUVD-2026-36838
GHSA-q946-p8hr-8q7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Stripe Payments ≤2.0.98
-
ExploitSend unauthenticated HTTP request to protected plugin endpoint
-
ExecutionBypass CWE-440 authentication check
-
ImpactAccess or modify payment-related plugin data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Expected behavior violation
|
| Exploitation Conditions | No special pre-authentication conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any WordPress installation running Stripe Payments plugin version 2.0.98 or earlier that is network-accessible. The target site must have the Stripe Payments plugin installed and active; deactivated plugins are not exploitable. Exploitation is limited by the constrained impact scope (C:L/I:L only) and the requirement that the vulnerable plugin version be deployed - sites that have updated beyond 2.0.98 are not affected. There is no dependency on a non-default WordPress configuration; the standard active-plugin state is sufficient. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium) reflects an unauthenticated, network-accessible attack requiring no user interaction (AV:N/AC:L/PR:N/UI:N), but with constrained impact limited to low confidentiality and low integrity (C:L/I:L/A:N), and no scope change (S:U). This vector is consistent with a bypass that exposes partial data or enables limited modification - not full site compromise or payment fraud outright. No EPSS data was provided in the intelligence package, preventing quantitative exploitation probability comparison. The absence of a CISA KEV entry and no identified public exploit code suggest this is not currently being mass-exploited; however, unauthenticated, low-complexity flaws in payment-handling plugins represent an attractive target due to the potential for financial data exposure. The CWE-440 classification suggests an inconsistency between design intent and implementation, which may be subtle and difficult to detect without source code review. Risk is elevated for publicly accessible WordPress sites running this plugin without network-layer restrictions; risk is lower in authenticated-only or access-controlled environments. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies a publicly accessible WordPress site running Stripe Payments 2.0.98 or earlier and sends a crafted HTTP request directly to a plugin endpoint that should require authentication, bypassing the intended access control. The attacker can then access payment-related data or alter plugin state with low confidentiality and integrity impact. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation does not require specialized tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated bypass in the Stripe Payments WordPress plugin (versions up to and including 2.0.98) allows remote, unauthenticated attackers to circumvent authentication controls, resulting in limited confidentiality and integrity impact against affected WordPress installations. Reported by Patchstack (ENISA EUVD-2026-36838), the flaw is classified under CWE-440 (Expected Behavior Violation), indicating the plugin's actual enforcement diverges from its intended or documented security model. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
RemediationAI
Update the Stripe Payments WordPress plugin to a version above 2.0.98 if a patched release has been issued by the vendor - consult the official WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/stripe-payments/vulnerability/wordpress-stripe-payments-plugin-2-0-98-bypass-vulnerability-vulnerability for the confirmed fix version, as an exact patched version number was not independently confirmed in the available intelligence data. If no patch is available or cannot be applied immediately, consider disabling the plugin until patched, which eliminates attack surface at the cost of losing Stripe payment functionality on the site. As a network-layer compensating control, restrict access to the WordPress admin and AJAX endpoints (wp-admin/, wp-login.php, admin-ajax.php) to trusted IP ranges using server configuration or a WAF rule, which limits unauthenticated attacker access at the cost of potentially blocking legitimate users if not carefully scoped. WordPress site hardening measures such as disabling XML-RPC and applying least-privilege user roles provide defense-in-depth but do not directly mitigate this bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the 'Stripe Payments' WordPress plugin developed by MRA13 / Team Tips and Tricks HQ, identified via CPE cpe:2.3:a:mra13_/_team_tips_and_tricks_hq:stripe_payments:*:*:*:*:*:*:*:*. This plugin integrates Stripe's payment gateway with WordPress sites, handling payment form submission and transaction processing. The root cause class is CWE-440 (Expected Behavior Violation), which specifically describes a scenario where a feature, API, or behavior does not function as the product's security documentation or intended design specifies. In the context of an authentication bypass, this means one or more plugin endpoints or AJAX actions that are documented or designed to require authentication or authorization verification fail to enforce those checks in practice, allowing unauthenticated HTTP requests to interact with protected functionality. This pattern is common in WordPress plugins that register wp_ajax_nopriv_ hooks inadvertently, or that rely on nonce-only checks without coupling them to capability verification.
Know when Stripe Payments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible WordPress plugin, no authentication required per description, limited data access and modification only, no availability or scope impact confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB