{
 "id": "WPSEC-2026-2966",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2966/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2966/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2966/index.md",
 "title": "WooCommerce Stripe Payment Gateway < 11.2.0 - Unauthenticated Insecure Direct Object Reference via Setup Intent",
 "description": "The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the setup intent ID used when adding or changing a saved payment method in versions 5.8.0 up to, and including, 11.1.2, due to missing validation that the user-supplied setup intent belongs to the current user's Stripe customer, and missing validation of the ID's format. This makes it possible for unauthenticated attackers who obtain another customer's setup intent ID to overwrite the billing details of that customer's payment method in Stripe, and for authenticated attackers with Subscriber-level access and above to also save that payment method as a token on their own account.",
 "plugin": {
  "slug": "woocommerce-gateway-stripe",
  "name": "WooCommerce Stripe Payment Gateway",
  "full_name": "WooCommerce Stripe Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-gateway-stripe/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-gateway-stripe/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.8.0",
    "from_inclusive": true,
    "to": "11.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.8.0 before 11.2.0"
  ]
 },
 "introduced_in": "5.8.0",
 "fixed_in": "11.2.0",
 "remediation": "Update to 11.2.0 or later.",
 "fix_released": "2026-11-10T11:39:39+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:13:53.909676+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2966/",
  "https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.2.0/",
  "https://wordpress.org/plugins/woocommerce-gateway-stripe/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}