# WooCommerce Stripe Payment Gateway < 11.2.0 - Unauthenticated Insecure Direct Object Reference via Setup Intent

- **ID:** WPSEC-2026-2966
- **Plugin:** WooCommerce Stripe Payment Gateway (`woocommerce-gateway-stripe`), https://wordpress.org/plugins/woocommerce-gateway-stripe/
- **Affected versions:** from 5.8.0 before 11.2.0
- **Fixed in:** 11.2.0 (Update to 11.2.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2966/

## Description

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the setup intent ID used when adding or changing a saved payment method in versions 5.8.0 up to, and including, 11.1.2, due to missing validation that the user-supplied setup intent belongs to the current user's Stripe customer, and missing validation of the ID's format. This makes it possible for unauthenticated attackers who obtain another customer's setup intent ID to overwrite the billing details of that customer's payment method in Stripe, and for authenticated attackers with Subscriber-level access and above to also save that payment method as a token on their own account.

## References

- https://wpsec.com/vuln/WPSEC-2026-2966/
- https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.2.0/
- https://wordpress.org/plugins/woocommerce-gateway-stripe/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2966/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.