CVE-2026-9618: PeachPay WordPress Plugin CSRF Vulnerability – Stripe Credentials at Risk

Technical summary

The peachpay_stripe_handle_admin_actions function fails to implement or properly validate nonce tokens on sensitive administrative actions. Nonces are WordPress's standard CSRF defense mechanism—random, time-limited tokens that prevent unauthorized requests from executing when submitted from external sites. Without proper nonce validation, an attacker can construct a request (via a forged form submission, image tag, or JavaScript) that deletes Stripe configuration data when a logged-in administrator visits the attacker's controlled page. The vulnerability affects the deletion of publishable keys, secret keys, webhook secrets, and Apple Pay configuration. The attack vector is network-based and requires user interaction (the admin must visit the malicious link), but places no other preconditions on successful exploitation.

Business impact

A successful attack disables Stripe payment processing without alerting the site administrator in real time. Depending on store configuration, this may be the primary or sole payment method, causing immediate checkout failures and potential revenue loss. Recovery requires the administrator to notice the outage, log in to the PeachPay settings, and manually reconfigure Stripe credentials—a process that adds downtime and operational overhead. For multi-vendor or high-traffic stores, the window of lost payments can be significant. Additionally, if the attacker performs this attack repeatedly or in coordination with other disruptions, it amplifies reputational and operational damage.

Affected systems

WordPress installations running the PeachPay — Payments & Express Checkout for WooCommerce plugin in any version up to and including 1.120.46 are affected. The plugin supports integration with Stripe, PayPal, Square, Authorize.net, and NMI; however, the CSRF flaw specifically targets the Stripe credential storage and deletion mechanism. Any WordPress site using PeachPay for Stripe payment processing is at risk if the site administrator is socially engineered into clicking a malicious link. The vulnerability does not require special server configuration or exposed debug endpoints.

Exploitability

Exploitability is moderate. The attack requires no specialized tools or knowledge—a threat actor can craft a simple HTML form or redirect that issues a forged DELETE request. However, success depends entirely on social engineering: the attacker must convince a WordPress administrator (a higher-privilege user) to click a link. The attack does not require the attacker to be authenticated, does not leak sensitive data directly, and does not achieve remote code execution. The low-friction nature of CSRF attacks—combined with phishing, forum comments, email, or malicious ads—makes this a practical risk in real-world scenarios, particularly against busy administrators or less security-aware organizations.

Remediation

Site administrators must update PeachPay to a patched version that implements proper nonce validation on all administrative actions, particularly peachpay_stripe_handle_admin_actions. Verify the patched version number against the vendor's official advisory and security changelog. After updating, administrators should review their Stripe configuration in the PeachPay settings to confirm that keys, webhooks, and Apple Pay settings remain intact. Additionally, implement WordPress security hardening: ensure administrators use strong, unique passwords; enable two-factor authentication; restrict administrative access by IP if feasible; and educate administrators to avoid clicking suspicious links.

Patch guidance

Consult the official PeachPay plugin repository and security advisories for the specific patched version number. Apply the update through the WordPress plugin dashboard (Plugins > Installed Plugins > PeachPay > Update if available) or via direct download from the vendor. After patching, test Stripe payment processing in a staging environment or on a test transaction to confirm credentials remain in place and are functional. If you cannot immediately patch, temporarily disable Stripe payment processing or restrict PeachPay admin access to trusted IP addresses as a temporary mitigation.

Detection guidance

Monitor WordPress admin access logs for unexpected or unusual DELETE or POST requests to the peachpay_stripe_handle_admin_actions endpoint. Review WooCommerce payment gateway settings and Stripe API dashboard for any unexplained removal or modification of API keys or webhook configurations. Implement Web Application Firewall (WAF) rules to flag or block requests to sensitive WordPress admin endpoints from untrusted referrers. Enable WordPress security audit logging (via plugins like Wordfence or similar) to capture administrative action history. Establish alerting on changes to payment gateway configuration to catch malicious deletion events shortly after they occur.

Why prioritize this

Although assigned a MEDIUM CVSS score, this vulnerability warrants prompt attention because it directly impacts payment processing, a critical business function. The attack surface is the WordPress administrator base, which is typically smaller and more targeted than end-user populations. Exploit barriers are low (social engineering is common), and remediation is straightforward (a plugin update). Organizations relying heavily on Stripe and operating in high-fraud environments or facing active phishing campaigns should prioritize this update urgently.

Risk score, explained

CVSS 3.1 scores this as 4.3 (MEDIUM): Network-accessible, low attack complexity, no privileges required, user interaction required, and limited integrity impact (deletion of configuration, not data exposure or code execution). The score reflects that this is a destructive but not data-exfiltrating attack, and it depends on social engineering. In practice, organizations with strong administrator awareness and access controls may face lower actual risk; those in active spear-phishing campaigns should treat this as higher priority regardless of the base CVSS.

Frequently asked questions