CVE-2026-2381: WooCommerce Stripe Payment Gateway Order Sabotage Vulnerability

Technical summary

The vulnerability exists in the `ajax_pay_for_order()` function within the WooCommerce Stripe Payment Gateway plugin (versions up to 10.7.0). The function processes payment requests via the `wc_stripe_pay_for_order` WC-AJAX endpoint but lacks critical authorization checks. While a nonce validation is present—providing some CSRF protection—the function does not verify order ownership, the order_key, or whether the requesting user has capability to modify the targeted order. An attacker can construct a request with a valid nonce (publicly available on any page with Express Checkout enabled), specify an arbitrary order ID, and submit invalid payment credentials. The resulting payment exception triggers an order status update to "failed" without proper permission validation. The vulnerability is classified as CWE-862 (Missing Authorization).

Business impact

Attackers can systematically corrupt pending orders in WooCommerce stores using this plugin, degrading customer experience and potentially disrupting revenue. A threat actor could target competitor sites or specific merchants by failing legitimate customer orders, forcing customers to re-initiate purchases and potentially damaging trust. Since the attack requires no authentication and relies only on publicly available information, the barrier to exploitation is extremely low. High-volume attacks could also create operational overhead for merchants attempting to recover and reinstate legitimate orders.

Affected systems

The WooCommerce Stripe Payment Gateway plugin in all versions up to and including 10.7.0 is affected. This plugin is widely deployed across WooCommerce-powered e-commerce sites using Stripe for payment processing. Any WooCommerce installation running this plugin with Express Checkout enabled is vulnerable, regardless of WordPress version or other plugin combinations.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no special privileges. An attacker needs only network access and the ability to craft HTTP requests to the vulnerable endpoint. The public availability of the nonce on checkout pages and the sequential predictability of WooCommerce order IDs make reconnaissance and targeting straightforward. Automated tooling could easily scale attacks across multiple targets.

Remediation

Upgrade the WooCommerce Stripe Payment Gateway plugin to a patched version beyond 10.7.0. Verify against the official Stripe and WooCommerce advisory for the exact fixed version. The patch should add proper order ownership and capability verification before processing payment modification requests. Store operators should also review recent order history for anomalous failed statuses that may indicate prior exploitation.

Patch guidance

Update the WooCommerce Stripe Payment Gateway plugin through the WordPress admin dashboard or via command line. Ensure the installed version exceeds 10.7.0—verify against the vendor security advisory to confirm the minimum patched version. Test the plugin update in a staging environment before deploying to production to ensure compatibility with your current WooCommerce and WordPress versions. Monitor for any reports of plugin conflicts or payment processing disruptions post-update.

Detection guidance

Monitor for unexpected failed order statuses on pending orders, particularly clustered in time or spanning sequential order ID ranges. Examine AJAX logs for repeated requests to the `wc_stripe_pay_for_order` endpoint originating from non-customer IP addresses or sessions without valid customer authentication. Review your payment gateway logs for rejected charges with invalid or test payment methods on legitimate orders. Consider implementing Web Application Firewall (WAF) rules to flag or rate-limit requests to this endpoint from suspicious sources.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), prioritization should remain high due to the ease of exploitation (no authentication required), the wide deployment of WooCommerce in e-commerce environments, and the direct business impact of order sabotage. The vulnerability poses immediate operational risk to any merchant using this plugin. The low barrier to entry and high scalability of attacks warrant expedited patching.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects network-exploitable (AV:N), low-complexity (AC:L) unauthorized access requiring no privileges (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), and the impact is low confidentiality (C:N), low integrity (I:L), and low availability (A:L)—because only order status is modified, not customer data exfiltration or system-wide denial. However, the practical risk is amplified by the plugin's ubiquity, the absence of exploitation barriers, and the reputational damage of order tampering in e-commerce contexts.

Frequently asked questions