Unauthorized Data Modification in WooCommerce Stripe Payment Gateway Plugin for WordPress

CVE-2026-2381

What is CVE-2026-2381?

The WooCommerce Stripe Payment Gateway plugin for WordPress is exposed to a significant vulnerability that allows unauthorized modification of data due to inadequate validation in the ajax_pay_for_order() function. This vulnerability has been traced to a lack of verification for order ownership or the order_key when payment processing occurs via the wc_stripe_pay_for_order WC-AJAX endpoint. The system merely checks for a nonce, which can be publicly accessed on any WooCommerce page with the Express Checkout feature. Consequently, this oversight allows unauthenticated attackers to manipulate order statuses by submitting fraudulent payment methods, bypassing legitimate ownership checks. By exploiting sequential order ID enumeration, attackers can force any pending order to a failed status, introducing potential payment exceptions and undermining the integrity of purchase processes.

References