Shopping Cart & eCommerce Store <= 6.0.3 - Unauthenticated Payment Bypass via Stripe Payment Intent Return Handler
- ID
- WPSEC-2026-0810
- Plugin
- WP EasyCart: Shopping Cart and eCommerce Store (wp-easycart)
- Affected
- all versions before 6.0.4
- Remediation
- Update to 6.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Shopping Cart & eCommerce Store on WPSec AttackSurface
- Fix released
- Published
Description
The WP EasyCart plugin for WordPress is vulnerable to Payment Bypass via the Stripe payment return handler (stripe=returning) in all versions up to, and including, 6.0.3, due to insufficient verification of the payment_intent_client_secret parameter. The handler accepts any PaymentIntent ID that Stripe reports as paid and uses a secret supplied in the request instead of checking it against the intent's real client secret. It stores the order under that supplied value but looks for existing orders under the real one, and it does not check that the payment matches the current cart total. This makes it possible for unauthenticated attackers to reuse a single paid PaymentIntent, such as a small payment of their own or another shopper's, to have the store create any number of orders for arbitrary carts. Those orders are marked as paid, take stock, and send receipts and purchased gift cards.
References
- https://wpsec.com/vuln/WPSEC-2026-0810/
- https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.4/
- https://wordpress.org/plugins/wp-easycart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS