WordPress Plugin Vulnerability Report – WooCommerce Stripe Payment Gateway – Cross-Site Request Forgery

Plugin Name: WooCommerce Stripe Payment Gateway

Key Information:

  • Software Type: Plugin
  • Software Slug: woocommerce-gateway-stripe
  • Software Status: Active
  • Software Author: automattic
  • Software Downloads: 28,425,774
  • Active Installs: 800,000
  • Last Updated: October 17, 2023
  • Patched Versions: 7.6.1
  • Affected Versions: <=7.6.0

Vulnerability Details:

  • Name: Stripe Gateway <= 7.6.0 - Cross-Site Request Forgery
  • Type: Cross-Site Request Forgery (CSRF)
  • CVSS Score: 5.4 (Medium)
  • Publicly Published: October 17, 2023
  • Description: The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 7.6.1 (exclusive). This is due to missing or incorrect nonce validation on the maybe_handle_redirect function. This makes it possible for unauthenticated attackers to change the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


The WooCommerce Stripe Payment Gateway for WordPress has a vulnerability in versions up to and including 7.6.0 that is susceptible to Cross-Site Request Forgery attacks. This vulnerability has been patched in version 7.6.1.

Detailed Overview:

The vulnerability discovered in the WooCommerce Stripe Payment Gateway plugin for WordPress allows unauthenticated attackers to exploit it through Cross-Site Request Forgery. This vulnerability stems from a missing or improperly validated nonce on the maybe_handle_redirect function. By leveraging this flaw, attackers can change the stripe connection settings if they can deceive a website administrator into executing an action, like clicking on a deceptive link.

Advice for Users:

  • Immediate Action: Encourage users to update to version 7.6.1 immediately.
  • Check for Signs of Vulnerability: Regularly inspect your site's Stripe connection settings. If you find any unauthorized changes, it could be an indication that your site has been compromised.
  • Alternate Plugins: While a patch is available, users might consider other plugins offering similar functionality as a precaution.
  • Stay Updated: Always ensure that your plugins, especially critical ones related to payments, are updated to the latest versions to mitigate vulnerabilities.


The swift action by the developers in patching this vulnerability highlights the critical nature of frequent software updates. Users are urged to make sure they have version 7.6.1 or a newer one installed to safeguard their WordPress sites.


 Detailed Report:

Maintaining the security of your website is critical, but with new vulnerabilities constantly being discovered, it can be challenging to stay on top of the latest threats. Unfortunately, I have some important news about a vulnerability recently reported in a popular WordPress plugin you may be using - the WooCommerce Stripe Payment Gateway. In this post, I'll provide an overview of the vulnerability, its risks, and most importantly, what you need to do to protect your site.

About the Plugin

The WooCommerce Stripe Payment Gateway allows WordPress sites to easily accept payments through Stripe. With over 28 million downloads and 800,000 active installs, it's one of the most widely used eCommerce plugins. The plugin is developed by Automattic, the company behind WordPress.com and Jetpack.

The Vulnerability

Researchers recently disclosed a vulnerability in the WooCommerce Stripe Payment Gateway plugin affecting all versions up to and including 7.6.0. The issue stems from improper input validation on a specific function, leaving it susceptible to Cross-Site Request Forgery (CSRF) attacks. CSRF vulnerabilities allow unauthorized users to perform state-changing actions by tricking an authorized user into clicking a link or visiting a site.

In this case, an attacker could potentially change the Stripe connection settings on a vulnerable site if they could lure an admin into clicking a link. While no specific attacks have been reported, sites running the affected versions should take prompt action.

Risks and Impacts

If successfully exploited, this vulnerability could allow attackers to change Stripe keys and access tokens, intercepting payments or accessing payment history and customer data. For eCommerce sites, unauthorized changes to payment connections can be catastrophic.

Fortunately, the plugin authors have already issued a patch in version 7.6.1. However, users of older versions should immediately update or take other precautions.

How to Update and Stay Secure

Here are steps you can take to secure your website:

  • Update to version 7.6.1 or newer immediately. This will fully patch the vulnerability.
  • Monitor your Stripe connection settings closely for any unauthorized changes.
  • Consider switching to alternate payment plugins as a precaution until more is known.
  • Make sure auto-updates are enabled for all plugins if available. This will ensure you get the latest security fixes.
  • Schedule regular WordPress software audits to detect outdated or vulnerable plugins.

Staying on top of plugin security is challenging, but critical for protecting your business. I recommend enabling automatic background updates for WordPress core, themes, and plugins whenever possible. I'm also happy to help monitor your site and implement best practices like two-factor authentication.

The Importance of Secure Software

This vulnerability highlights why using up-to-date software is imperative for security. New threats emerge constantly, so developers must remain committed to fixing flaws. As a website owner, you play a key role as well. Taking steps to stay on top of software updates and monitor for issues can help keep your business secure.

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WordPress Plugin Vulnerability Report – WooCommerce Stripe Payment Gateway – Cross-Site Request Forgery FAQs

Leave a Comment