# WooCommerce Stripe Payment Gateway <= 11.1.1 - Unauthenticated Payment Bypass via Payment Intent to Order Binding

- **ID:** WPSEC-2026-3001
- **Plugin:** WooCommerce Stripe Payment Gateway (`woocommerce-gateway-stripe`), https://wordpress.org/plugins/woocommerce-gateway-stripe/
- **Affected versions:** from 9.1.0 before 11.1.2
- **Fixed in:** 11.1.2 (Update to 11.1.2 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3001/

## Description

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the payment_intent webhook handling in versions 9.1.0 up to, and including, 11.1.1, due to the order to settle being chosen from the order_id metadata of a PaymentIntent without checking that the intent is the one stored on that order or carries its order key, and without checking that the settled amount matches the order total. This makes it possible for unauthenticated attackers, under certain conditions, to complete a different or stale lower-value PaymentIntent and have an order marked as paid without paying its full total.

## References

- https://wpsec.com/vuln/WPSEC-2026-3001/
- https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.1.2/
- https://wordpress.org/plugins/woocommerce-gateway-stripe/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3001/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.