CVE-2026-2381: WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxpayfororder() function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or orderkey verification when processing payment for an order via the wcstripepayfororder WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Express Checkout if it is not required. The nonce used by ajax_pay_for_order is publicly available on WooCommerce pages when Express Checkout is enabled, increasing exposure.
WooCommerce Stripe Payment Gateway Express Checkout = disabled - Configuration
Modify the ajax_pay_for_order() handler (wc_stripe_pay_for_order WC-AJAX endpoint) to verify that the requesting user owns the target order or to validate the order_key and to perform appropriate capability/authorization checks before processing payment or updating order status.
WooCommerce Stripe Payment Gateway ajax_pay_for_order authorization = require order ownership or order_key verification and capability check - Compensating control
Restrict access to the WC-AJAX endpoint wc_stripe_pay_for_order (for example via web application firewall rules, server configuration, or IP allowlisting) so that unauthenticated requests cannot invoke the endpoint.
- Operational
Audit recent orders for unexpected or unauthorized transitions to 'failed' status (especially via sequential order ID enumeration) and restore legitimate pending orders as needed; investigate logs for attempts to invoke wc_stripe_pay_for_order with arbitrary order IDs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2381?
CVE-2026-2381 has a medium severity rating of 6.5.
How do I fix CVE-2026-2381?
To fix CVE-2026-2381, update the WooCommerce Stripe Payment Gateway plugin to version 10.7.1 or higher.
What kind of vulnerability is CVE-2026-2381?
CVE-2026-2381 is a vulnerability that allows unauthorized manipulation of order status due to a missing authorization check.
Who is affected by CVE-2026-2381?
CVE-2026-2381 affects all versions of the WooCommerce Stripe Payment Gateway up to and including 10.7.0.
What is the impact of CVE-2026-2381?
The impact of CVE-2026-2381 includes the potential for an attacker to modify order data without proper authorization.