WooCommerce Stripe Payment Gateway < 11.2.0 - Unauthenticated Insecure Direct Object Reference via Setup Intent
- ID
- WPSEC-2026-2966
- Plugin
- WooCommerce Stripe Payment Gateway (woocommerce-gateway-stripe)
- Affected
- from 5.8.0 before 11.2.0
- Remediation
- Update to 11.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-12
- Attack surface
- WooCommerce Stripe Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the setup intent ID used when adding or changing a saved payment method in versions 5.8.0 up to, and including, 11.1.2, due to missing validation that the user-supplied setup intent belongs to the current user's Stripe customer, and missing validation of the ID's format. This makes it possible for unauthenticated attackers who obtain another customer's setup intent ID to overwrite the billing details of that customer's payment method in Stripe, and for authenticated attackers with Subscriber-level access and above to also save that payment method as a token on their own account.
References
- https://wpsec.com/vuln/WPSEC-2026-2966/
- https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.2.0/
- https://wordpress.org/plugins/woocommerce-gateway-stripe/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS