CVE-2026-2381

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.

• CWE-862

• https://plugins.trac.wordpress.org/browser/woocommerce-gateway-stripe/tags/10.3.1/includes/class-wc-gateway-stripe.php#L523
• https://plugins.trac.wordpress.org/browser/woocommerce-gateway-stripe/tags/10.3.1/includes/payment-methods/class-wc-stripe-express-checkout-ajax-handler.php#L355
• https://plugins.trac.wordpress.org/changeset/3564842/woocommerce-gateway-stripe/trunk/includes/payment-methods/class-wc-stripe-express-checkout-ajax-handler.php
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-gateway-stripe/tags/10.7.0&new_path=%2Fwoocommerce-gateway-stripe/tags/10.8.0
• https://research.cleantalk.org/cve-2026-2381
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3b52f7-e2c3-44f7-8e19-b6c51ccd50e0?source=cve

Published

Jun 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23804Missing Authorization vulnerability in BBR Plugins Better Bu…5.4
• CVE-2026-23805Improper Neutralization of Special Elements used in an SQL C…7.6
• CVE-2026-23806Missing Authorization vulnerability in BlueGlass Interactive…7.5
• CVE-2026-23807Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-23808A vulnerability has been identified in a standardized wirele…8.1
• CVE-2026-23809A technique has been identified that adapts a known port-ste…7.6
• CVE-2026-23810A vulnerability in the packet processing logic may allow an …3.1
• CVE-2026-23811A vulnerability in the client isolation mechanism may allow …3.1
• CVE-2026-23812A vulnerability has been identified where an attacker connec…4.2
• CVE-2026-23813A vulnerability has been identified in the web-based managem…9.8
• CVE-2026-23814A vulnerability in the command parameters of a certain AOS-C…8.8
• CVE-2026-23815A vulnerability in a custom binary used in AOS-CX Switches' …7.2