Payment Plugins For Stripe Woocommerce
Monthly
Unauthenticated billing data exposure in Payment Plugins for Stripe WooCommerce (versions before 4.0.12) allows any remote attacker to enumerate all WooCommerce orders and retrieve their full billing details plus the per-order secret key embedded in front-end JavaScript. The root cause is missing order key validation before order data is serialized into the plugin's client-side configuration, combined with WooCommerce's use of sequential, predictable order identifiers that make enumeration trivial. A publicly available exploit exists per WPScan, and the SSVC assessment confirms the attack is automatable, though EPSS remains low (0.14%) suggesting no widespread active exploitation at time of analysis.
Order fulfillment fraud in the Payment Plugins for Stripe WooCommerce WordPress plugin allows unauthenticated network attackers to mark arbitrary pending WooCommerce orders as paid without actual payment. Any store running version 4.0.7 or earlier with the default blank webhook secret is exposed to fraudulent goods acquisition, as the plugin's webhook endpoint accepts and processes forged Stripe charge events without signature verification. No public exploit has been identified at time of analysis, but the attack requires no credentials, targets the default installation state, and is trivially automatable.
Unauthenticated billing data exposure in Payment Plugins for Stripe WooCommerce (versions before 4.0.12) allows any remote attacker to enumerate all WooCommerce orders and retrieve their full billing details plus the per-order secret key embedded in front-end JavaScript. The root cause is missing order key validation before order data is serialized into the plugin's client-side configuration, combined with WooCommerce's use of sequential, predictable order identifiers that make enumeration trivial. A publicly available exploit exists per WPScan, and the SSVC assessment confirms the attack is automatable, though EPSS remains low (0.14%) suggesting no widespread active exploitation at time of analysis.
Order fulfillment fraud in the Payment Plugins for Stripe WooCommerce WordPress plugin allows unauthenticated network attackers to mark arbitrary pending WooCommerce orders as paid without actual payment. Any store running version 4.0.7 or earlier with the default blank webhook secret is exposed to fraudulent goods acquisition, as the plugin's webhook endpoint accepts and processes forged Stripe charge events without signature verification. No public exploit has been identified at time of analysis, but the attack requires no credentials, targets the default installation state, and is trivially automatable.