CVE-2024-0705: Stripe Payment WooCommerce SQLi Flaw

CVE-2024-0705 Overview

CVE-2024-0705 is a SQL Injection vulnerability in the Stripe Payment Plugin for WooCommerce by Webtoffee, affecting all versions up to and including 3.7.9. The flaw resides in handling of the id parameter, which is not properly escaped before being concatenated into an SQL query. Unauthenticated attackers can append additional SQL statements to the existing query to extract sensitive data from the WordPress database. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive database contents — including customer payment records and WordPress user credentials — through crafted requests to the vulnerable endpoint.

Affected Products

Webtoffee Stripe Payment Plugin for WooCommerce versions up to and including 3.7.9
WordPress sites running the payment-gateway-stripe-and-woocommerce-integration plugin
WooCommerce stores relying on the Webtoffee Stripe integration for checkout

Discovery Timeline

2024-01-19 - CVE-2024-0705 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-0705

Vulnerability Analysis

The plugin exposes a request handler that accepts an id parameter from user input and incorporates it directly into a SQL statement. The code performs insufficient escaping and does not use a prepared statement with bound parameters. An attacker can therefore break out of the intended query context and append arbitrary SQL clauses. Because the endpoint is reachable without authentication, exploitation requires only network access to the target WordPress site. Successful attacks expose database contents such as wp_users credentials, session tokens, and order metadata associated with WooCommerce transactions.

Root Cause

The root cause is improper neutralization of special characters in a SQL command [CWE-89]. The plugin concatenates the id value into a query string rather than using WordPress's $wpdb->prepare() API with placeholders. WordPress provides safe query construction helpers, but they are bypassed in the vulnerable code path, leaving the query susceptible to classic union-based and boolean-based SQL injection techniques.

Attack Vector

Exploitation occurs over the network against the public-facing WordPress endpoint registered by the plugin. The attacker issues an HTTP request supplying a malicious id value containing SQL metacharacters and additional statements such as UNION SELECT. The injected payload executes within the database context used by WordPress, returning attacker-controlled data in the response or via inference. No user interaction or prior authentication is required.

No public proof-of-concept code has been verified for this issue. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-0705

Indicators of Compromise

HTTP requests to plugin endpoints containing SQL metacharacters such as ', --, UNION, or SLEEP( within the id parameter
Unexpected SELECT queries against wp_users, wp_usermeta, or wp_options originating from the WooCommerce request path
Outbound responses with abnormally large payloads or database error strings such as You have an error in your SQL syntax
Web server access logs showing repeated requests with incrementing or boolean-style id values from a single source IP

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting the id parameter on WooCommerce and Stripe plugin routes
Inspect MySQL general or slow query logs for queries containing concatenated UNION SELECT clauses originating from PHP-FPM workers
Correlate anomalous query volumes with HTTP request bursts using SIEM analytics on web and database telemetry

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward access logs to a centralized log platform for retroactive hunting
Alert on plugin version 3.7.9 or earlier reported by asset inventory or WordPress version scanners
Monitor for new or modified administrator accounts in wp_users following any suspicious request activity

How to Mitigate CVE-2024-0705

Immediate Actions Required

Update the Stripe Payment Plugin for WooCommerce to version 3.8.0 or later, which contains the upstream fix
Audit recent web and database logs for evidence of injection attempts against the vulnerable id parameter
Rotate WordPress administrator passwords, API keys, and Stripe secret keys if exploitation cannot be ruled out

Patch Information

Webtoffee released a fix in the plugin repository. The corrective changeset is published in the WordPress plugin trac at WordPress Plugin Changeset 2954934. The patch introduces proper parameter sanitization and prepared statements for the affected query.

Workarounds

If immediate patching is not possible, disable the Stripe Payment Plugin for WooCommerce until the update can be applied
Place the WordPress site behind a WAF and enable rule sets that block SQL injection patterns on plugin endpoints
Restrict database user privileges so the WordPress account cannot read sensitive tables outside its operational scope

bash

# Update the vulnerable plugin using WP-CLI
wp plugin update payment-gateway-stripe-and-woocommerce-integration
wp plugin get payment-gateway-stripe-and-woocommerce-integration --field=version