WooCommerce Stripe Payment Gateway <= 11.1.1 - Unauthenticated Payment Bypass via Payment Intent to Order Binding
- ID
- WPSEC-2026-3001
- Plugin
- WooCommerce Stripe Payment Gateway (woocommerce-gateway-stripe)
- Affected
- from 9.1.0 before 11.1.2
- Remediation
- Update to 11.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-12
- Attack surface
- WooCommerce Stripe Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the payment_intent webhook handling in versions 9.1.0 up to, and including, 11.1.1, due to the order to settle being chosen from the order_id metadata of a PaymentIntent without checking that the intent is the one stored on that order or carries its order key, and without checking that the settled amount matches the order total. This makes it possible for unauthenticated attackers, under certain conditions, to complete a different or stale lower-value PaymentIntent and have an order marked as paid without paying its full total.
References
- https://wpsec.com/vuln/WPSEC-2026-3001/
- https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.1.2/
- https://wordpress.org/plugins/woocommerce-gateway-stripe/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS