CVE-2026-80339 in Payment Plugins for Stripe WooCommerce Plugin
Summary
by MITRE • 09/09/2026
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Payment Plugins for Stripe WooCommerce WordPress prior to version 4.0.12 represents a critical failure in server-side input validation and authorization controls within the plugin's frontend JavaScript configuration generation logic. The core technical flaw lies in the absence of an integrity check on the order key parameter before it is utilized to populate client-side script variables with sensitive order data. In standard WooCommerce architecture, each order is associated with a unique, cryptographically random order key that serves as a secret token required for accessing specific order details via frontend endpoints or scripts. This mechanism is designed to prevent unauthorized access by ensuring that only users possessing the valid key can retrieve information related to a specific transaction. However, in this vulnerable implementation, the plugin accepts an arbitrary order identifier provided by the client and proceeds to embed associated billing data into the JavaScript output without verifying whether the supplied order key matches the one stored server-side for that particular order ID.
This lack of validation creates a direct path for unauthenticated attackers to exploit the system through sequential enumeration attacks. Because WooCommerce typically generates order identifiers using predictable, incrementing integer sequences, an attacker can systematically iterate through these numerical IDs while simultaneously guessing or brute-forcing the corresponding order keys if they are not sufficiently complex, or more commonly, by leveraging the fact that many sites may have weak key generation practices or where the vulnerability allows access regardless of key validity due to a logic error in how the configuration is rendered. By sending requests with sequential order identifiers and potentially manipulated or empty order keys, an attacker can trigger the plugin's JavaScript output mechanism repeatedly. Each successful request returns a block of code containing sensitive billing information such as customer names, addresses, email addresses, phone numbers, and payment details for that specific order.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the sensitivity of the data exposed. Since no authentication or valid session token is required to initiate these requests, any internet user can exploit it without prior access credentials. The ability to harvest billing details en masse through simple iteration poses a significant risk to customer privacy and violates fundamental principles of data protection regulations such as GDPR and PCI DSS requirements for safeguarding cardholder information. Furthermore, the exposure of this personal identifiable information facilitates downstream attacks including targeted phishing campaigns, identity theft, and social engineering efforts against both individual customers and potentially high-value corporate clients whose orders might be processed through the compromised site. The ease of exploitation means that automated scanning tools can rapidly compromise large volumes of data with minimal effort from the attacker.
Mitigation strategies must focus on immediate remediation followed by long-term architectural improvements. The primary and most effective solution is to upgrade the Payment Plugins for Stripe WooCommerce WordPress plugin to version 4.0.12 or later, where this validation logic has been corrected to ensure that the order key is strictly verified against server-side records before any sensitive data is included in the JavaScript configuration output. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations include implementing Web Application Firewall rules that detect and block patterns indicative of sequential enumeration attacks on WooCommerce endpoints. Additionally, administrators should review their site's security posture by ensuring that all plugins are updated regularly and consider restricting access to sensitive administrative functions through IP whitelisting or two-factor authentication where applicable. It is also advisable to audit the database for any orders whose keys may have been exposed during the window of vulnerability and notify affected customers if necessary, in accordance with breach notification laws.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper authorization checks before accessing sensitive resources. It also maps closely to CWE-601 URL Redirection to Untrusted Site and CWE-918 Server-Side Request Forgery concepts in terms of how external input dictates server behavior without validation. In the context of the MITRE ATT&CK framework, this exploit technique falls under T1504 Web Session Cookie manipulation or more broadly under Initial Access techniques involving exploitation of public-facing applications for data exfiltration. The specific method of iterating through sequential identifiers to harvest data is characteristic of automated reconnaissance and data collection phases often seen in supply chain attacks or large-scale credential stuffing campaigns, although here the target is personally identifiable information rather than authentication credentials directly. Addressing this issue requires not only patching but also reinforcing general best practices for handling user-supplied input in dynamic web applications to prevent similar logic flaws in other components of the ecosystem.