CVE-2026-2381 affects WooCommerce Stripe Payment Gateway and allows unauthenticated attackers to change pending orders to Failed through the public wc_stripe_pay_for_order endpoint. The handler accepts a supplied order ID without checking order ownership or an order key. A request with a fake payment method can trigger a payment error that changes the selected order status. Versions through 10.7.0 are affected, with a fix in 10.8.0.
| CVE | CVE-2026-2381 |
| Plugin Version | WooCommerce Stripe Payment Gateway <= 10.7.0, fixed in 10.8.0 |
| All Time | 49 622 794 |
| Active installations | 700 000+ |
| Publicly Published | June 15, 2026 |
| Last Updated | June 16, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-284 – Improper Access Control CWE-862 – Missing Authorization in the CVE record |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-2381 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-gateway-stripe/woocommerce-stripe-payment-gateway-1070-missing-authorization-to-unauthenticated-order-status-manipulation-via-order-parameter |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| February 2, 2026 | Plugin testing and vulnerability detection in WooCommerce Stripe Gateway 10.3.1 were completed. |
| February 2, 2026 | The vulnerability was reported with the PoC and technical description. |
| June 15, 2026 | Wordfence publicly published the advisory for CVE-2026-2381. |
| June 16, 2026 | The CVE record was published in the CVE Program registry. |
Discovery of the Vulnerability
The issue was identified in version 10.3.1 while examining the Express Checkout payment flow. The public WC-AJAX action maps to WC_Stripe_Express_Checkout_Ajax_Handler::ajax_pay_for_order() in includes/payment-methods/class-wc-stripe-express-checkout-ajax-handler.php. The handler at lines 356 to 413 validates the wc-stripe-pay-for-order nonce, requires the Stripe payment method and a nonempty wc-stripe-payment-method value, then loads the supplied order. It checks that the order exists and needs payment, but never verifies an order key, ownership, or permission to act on that order.
The handler then calls process_payment($order_id). Omitting a valid payment source while supplying the required fake payment method can reach the gateway error path. In the exception handler at lines 516 to 529 of includes/class-wc-gateway-stripe.php, a WC_Stripe_Exception leads to update_status(OrderStatus::FAILED). The order is changed before the AJAX handler returns its error response. The needs_payment() check limits this path to orders that still require payment.
Understanding of Missing Authorization attacks
A nonce exposed on a public checkout page does not establish ownership of an order. Here, the caller supplies the numeric object identifier and the application starts a payment operation against that object without checking the caller’s authority. The report describes this as CWE-284 – Improper Access Control. The CVE record uses the more specific CWE-862 – Missing Authorization classification.
The demonstrated impact is a change to Failed, rather than the separate WooCommerce Cancelled status. A successful charge is not required. Because order IDs may be sequential, the missing authorization check can expose other pending orders to the same tampering. Failed orders can interrupt checkout, trigger notifications or retries, and create additional support work.
Exploiting the Missing Authorization Vulnerability
The supplied research PoC targets version 10.3.1 and uses pm_FAKE to satisfy the handler’s nonempty payment-method requirement without providing a valid payment source. Use the single disposable order in the local test store for the following reproduction.
POC:
POC: 1. Use an isolated WooCommerce test store with WooCommerce Stripe Gateway 10.3.1 and Express Checkout assets enabled. 2. Create a disposable pending order belonging to a test customer. The example uses order 313. 3. In a separate logged-out browser session, open a checkout page that loads the Express Checkout assets. 4. Read wc_stripe_express_checkout_params.nonce.pay_for_order and replace <PAY_FOR_ORDER_NONCE> below with its actual value. 5. Send the request without a WordPress login cookie, an order key, stripe_source, or stripe_token. POST /wordpress/?wc-ajax=wc_stripe_pay_for_order HTTP/1.1 Host: 127.0.0.1 Accept: application/json Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Origin: http://127.0.0.1 Referer: http://127.0.0.1/wordpress/checkout/ _ajax_nonce=<PAY_FOR_ORDER_NONCE>&payment_method=stripe&order=313&wc-stripe-payment-method=pm_FAKE 6. As the test store administrator, inspect order 313 and confirm that it changed from Pending payment to Failed.____
The nonce placeholder must be replaced with the value from the public page. An invalid nonce or an order that does not need payment will not reach the demonstrated status update. The relevant result is the order’s persisted Failed status, even though the payment request itself returns an error.
Recommendations for Improved Security
Store owners should update WooCommerce Stripe Payment Gateway to 10.8.0 or a later patched release, as specified in the advisory. Check recently failed orders for unexpected transitions and review gateway logs when investigating interrupted payments.
Developers should verify authorization for the exact order before invoking payment processing or changing its state. Guest payment flows need a valid order key or an equivalent order-bound authorization mechanism. Customer flows must verify ownership, and administrative actions need an appropriate capability check. Nonce verification and the order’s payment eligibility remain separate checks. Requests that fail authorization must leave the order unchanged.
Protecting WooCommerce order authorization in CVE-2026-2381 keeps an unauthenticated payment request from changing another customer’s order. Applying the patched gateway release closes this reported path.
#WordPressSecurity #WooCommerce #MissingAuthorization #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
