CVE-2023-34000

HighCVSS 7.5

Published: 14/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.21%

65th percentile - higher than 65% of all known CVEs

Summary

The WooCommerce Stripe Payment Gateway plugin versions <= 7.4.0 has an IDOR vulnerability that allows unauthorized access to users' personal data.

Risk Assessment

Exploitation of this vulnerability may lead to the disclosure of personal information, posing a serious threat to user privacy and the organization's reputation.

Recommendation

It is recommended to update the WooCommerce Stripe Payment Gateway plugin to the latest version to mitigate this vulnerability.

Other vulnerabilities in WooCommerce Stripe Payment Gateway plugin

CVE-2026-2381Medium
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the `ajax_pay_for_order()` function. This affects all versions up to and including 10.7.0, where there is no verification of order ownership or order_key when processing payment.

Original NVD description (English source)

Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS