WooCommerce Stripe Payment Gateway Plugin up to 10.7.0 on WordPress AJAX Endpoint ajax_pay_for_order authorization

Summaryinfo

A vulnerability described as critical has been identified in WooCommerce Stripe Payment Gateway Plugin up to 10.7.0 on WordPress. This vulnerability affects the function ajax_pay_for_order of the component AJAX Endpoint. Such manipulation leads to authorization. This vulnerability is traded as CVE-2026-2381. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in WooCommerce Stripe Payment Gateway Plugin up to 10.7.0 on WordPress and classified as critical. Affected by this issue is the function ajax_pay_for_order of the component AJAX Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity, and availability. CVE summarizes:

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.

The weakness was shared by Dmitrii Ignatyev. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-2381 since 02/11/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37059). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• E-Commerce Management Software

Vendor

• WooCommerce

Name

• Stripe Payment Gateway Plugin

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion