Executive Summary

The WooCommerce Stripe Payment Gateway plugin for WordPress has a vulnerability in the ajax_pay_for_order() function up to version 10.7.0. This function lacks proper capability checks and does not verify if the user owns the order or has the correct order key when processing payments via the wc_stripe_pay_for_order WC-AJAX endpoint.

Although the function validates a nonce, this nonce is publicly available on any WooCommerce page with Express Checkout enabled, so it does not provide sufficient protection.

As a result, unauthenticated attackers can manipulate pending orders by forcing them into a failed status using a fake payment method. This is done by enumerating order IDs sequentially and causing payment exceptions that update the order status to "failed."

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to modify order data without authorization.

Specifically, attackers can force any pending order into a failed status by submitting fake payment information, which disrupts the normal payment process.

This can lead to denial of service for legitimate customers trying to complete their purchases, potential loss of sales, and administrative overhead to resolve incorrect order statuses.

Useful 0 Not Useful 0