{
 "id": "WPSEC-2026-3003",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3003/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3003/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3003/index.md",
 "title": "WooCommerce Stripe Payment Gateway <= 11.1.1 - Unauthenticated Integer Overflow to Payment Amount Manipulation",
 "description": "The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Integer Overflow via the get_stripe_amount() function in all versions up to, and including, 11.1.1, due to order totals being converted to Stripe minor units with absint() without rejecting values above Stripe's maximum or PHP's integer limit. This makes it possible for unauthenticated attackers to build a cart with an extremely large total, for example through a huge quantity of an item without stock limits, that wraps around to a much smaller charged amount. The order is then paid for far less than its total.",
 "plugin": {
  "slug": "woocommerce-gateway-stripe",
  "name": "WooCommerce Stripe Payment Gateway",
  "full_name": "WooCommerce Stripe Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-gateway-stripe/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-gateway-stripe/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-190"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.1.2",
 "remediation": "Update to 11.1.2 or later.",
 "fix_released": "2026-11-11T19:06:22+00:00",
 "published": "2026-11-12T19:42:40+00:00",
 "updated": "2026-11-12T17:12:56.898164+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3003/",
  "https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.1.2/",
  "https://wordpress.org/plugins/woocommerce-gateway-stripe/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}