WooCommerce Stripe Gateway EUVD-2026-37059

The WooCommerce Stripe Express Checkout feature must be enabled on the target store - this is what exposes the public nonce on storefront pages, which is the only credential the endpoint validates. The target orders must be in a 'pending' status (i.e., awaiting payment); already-paid or completed orders are unaffected. No authentication, account registration, or prior order interaction is required from the attacker. Exploitation is limited to degrading order status to 'failed' - no confidential data (customer PII, card numbers) is exposed, and no financial transactions are charged or reversed. Sequential WooCommerce order IDs are predictable integers, making enumeration trivial. Stores that have disabled Express Checkout (Apple Pay / Google Pay / Link) are not vulnerable via this endpoint, as the nonce would not be present on public pages.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) accurately reflects the attack posture: fully network-accessible with zero authentication or user interaction required. While the individual order-level impact appears moderate (I:L, A:L), the operational business risk compounds with scale - an attacker can enumerate and fail entire batches of pending orders rapidly, potentially causing significant revenue loss, customer service disruption, and reputational damage for affected merchants. No EPSS score was provided in the intelligence data; however, given the trivially low complexity (public nonce plus sequential integer order IDs) and the large attack surface of WooCommerce stores globally, real-world exploitability is likely higher than a mid-range CVSS score suggests. There is no CISA KEV listing and no confirmed public POC at time of analysis, but the mechanics are straightforward enough that exploitation could be independently developed quickly. The primary limiting factor is that Express Checkout must be enabled - stores that have disabled this feature are not exposed through this path. No conflicting signals exist between the CVSS vector and the description.

An attacker visits any WooCommerce storefront page that renders Express Checkout buttons (product pages, cart, checkout) and extracts the publicly embedded WC nonce from the page source or JavaScript globals. The attacker then writes a simple script that iterates integer order IDs starting from 1, issuing POST requests to /?wc-ajax=wc_stripe_pay_for_order with each order ID, the harvested nonce, and a fabricated payment method token. For each pending order hit, the Stripe gateway raises a payment exception, WooCommerce transitions the order to 'failed' status, and the merchant receives a failure notification - all without the attacker possessing any account or order credential.