CVE-2026-2381
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile — higher than 37% of all known CVEs
Summary
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the `ajax_pay_for_order()` function. This affects all versions up to and including 10.7.0, where there is no verification of order ownership or order_key when processing payment.
Risk Assessment
Unauthenticated attackers can force any pending order to a 'failed' status, potentially leading to financial losses and disruptions in the order process.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional user permission verification mechanisms.
Original NVD description (English source)
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.