{
 "id": "WPSEC-2026-3001",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3001/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3001/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3001/index.md",
 "title": "WooCommerce Stripe Payment Gateway <= 11.1.1 - Unauthenticated Payment Bypass via Payment Intent to Order Binding",
 "description": "The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the payment_intent webhook handling in versions 9.1.0 up to, and including, 11.1.1, due to the order to settle being chosen from the order_id metadata of a PaymentIntent without checking that the intent is the one stored on that order or carries its order key, and without checking that the settled amount matches the order total. This makes it possible for unauthenticated attackers, under certain conditions, to complete a different or stale lower-value PaymentIntent and have an order marked as paid without paying its full total.",
 "plugin": {
  "slug": "woocommerce-gateway-stripe",
  "name": "WooCommerce Stripe Payment Gateway",
  "full_name": "WooCommerce Stripe Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-gateway-stripe/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-gateway-stripe/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "9.1.0",
    "from_inclusive": true,
    "to": "11.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 9.1.0 before 11.1.2"
  ]
 },
 "introduced_in": "9.1.0",
 "fixed_in": "11.1.2",
 "remediation": "Update to 11.1.2 or later.",
 "fix_released": "2026-11-11T19:06:22+00:00",
 "published": "2026-11-12T19:42:40+00:00",
 "updated": "2026-11-12T17:12:56.898164+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3001/",
  "https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.1.2/",
  "https://wordpress.org/plugins/woocommerce-gateway-stripe/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}