CVE-2023-3162
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to and including 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin.
Risk Assessment
Unauthenticated attackers can log in as users who have orders, which poses a risk of unauthorized access to customer data.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and ensure proper user verification.
Original NVD description (English source)
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically customers.