Critical severity · published Aug 31, 2023
CVE-2023-3162
Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically customers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Payment Gateway of Stripe for WooCommerce · themehigh
through 3.7.7 · source: vendor
SP
Stripe Payment Plugin For Woocommerce · Webtoffee
through 3.7.7 · source: NVD
Affected product
PG
Payment Gateway of Stripe for WooCommerce
themehigh
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3162
Patch
https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/3.7.7/includes/class-stripe-checkout.php#L640
Patch
https://plugins.trac.wordpress.org/changeset/2925361/payment-gateway-stripe-and-woocommerce-integration
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/4d052f3e-8554-43f0-a5ae-1de09c198d7b?source=cve
More from Payment Gateway of Stripe for WooCommerce
7.5
CVE-2024-0705
Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
5.3
CVE-2026-9832
Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint