Stripe For WooCommerce

Stripe For WooCommerce through 4.0.7 permits an unauthenticated request to reach a plugin operation without the required access-control check. The Patchstack CNA record does not disclose the payment route, action, parameter, function, protected object or concrete operation, so the exact payment or order impact remains unknown.

Payment Plugins for Stripe WooCommerce through 4.0.7 accepts POST requests to /wp-json/wc-stripe/v1/webhook while the selected live or test webhook secret is blank, which is the plugin's default until a Stripe-issued secret is configured. An unauthenticated attacker can forge a charge.pending event whose metadata.order_id and metadata.gateway_id select a pending asynchronous order and payment gateway; a charge object with status=succeeded and captured=true reaches wc_stripe_process_charge_pending() and payment_complete(), marking the order paid and potentially starting fulfillment with an attacker-supplied transaction ID.