CVE-2026-80339

Deferred Deferred - Pending Action

Unauthenticated Order Data Exposure in Stripe WooCommerce Payment Plugins

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-80339

EUVD

EUVD-2026-74704

Affected Vendors & Products

Vendor	Product	Version / Range
payment_plugins	stripe_woocommerce	to 4.0.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Payment Plugins for Stripe WooCommerce WordPress plugin before version 4.0.12. It allows unauthenticated users to access sensitive order data by exploiting a flaw in the order-pay functionality. The plugin fails to validate the order key before including order details in the front-end JavaScript configuration, enabling attackers to retrieve billing information and secret keys by iterating through sequential order identifiers.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Payment Plugins for Stripe WooCommerce plugin version prior to 4.0.12. Inspect the plugin version in the WordPress admin panel under Plugins. If outdated, the site is vulnerable. No specific network commands are provided, but manual verification of the plugin version is required.

Impact Analysis

Unauthenticated attackers can obtain billing details of any order, including personally identifiable information (PII), by sequentially guessing order IDs. They can also access the secret key required to interact with those orders, potentially leading to unauthorized transactions or further exploitation of customer data.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if payment-related PII is involved. It exposes sensitive customer information, risking non-compliance with data protection requirements for handling and securing personal health or financial data.

Mitigation Strategies

Immediately update the Payment Plugins for Stripe WooCommerce plugin to version 4.0.12 or later. This can be done via the WordPress admin panel under Plugins. After updating, verify the plugin is active and functioning correctly. Consider temporarily disabling the plugin if an update is not immediately possible.

Hi! I’m here to help you understand CVE-2026-80339. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70