CVE-2026-2381 Overview
CVE-2026-2381 is a missing authorization vulnerability [CWE-862] in the WooCommerce Stripe Payment Gateway plugin for WordPress. The flaw affects all versions up to and including 10.7.0. The ajax_pay_for_order() function exposed by the wc_stripe_pay_for_order WC-AJAX endpoint validates a publicly available nonce but does not verify order ownership or the order_key value. Unauthenticated attackers can enumerate sequential order IDs and force pending orders into a failed state by submitting an invalid payment method, triggering a payment exception that updates the order status.
Critical Impact
Unauthenticated attackers can transition arbitrary pending WooCommerce orders to a failed status, disrupting order fulfillment and merchant revenue flows.
Affected Products
- WooCommerce Stripe Payment Gateway plugin for WordPress versions through 10.7.0
- WordPress sites running WooCommerce with Stripe Express Checkout enabled
- Fixed in WooCommerce Stripe Payment Gateway version 10.8.0
Discovery Timeline
- 2026-06-16 - CVE-2026-2381 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-2381
Vulnerability Analysis
The vulnerability resides in the ajax_pay_for_order() handler registered on the wc_stripe_pay_for_order WC-AJAX endpoint. The function processes payment retries for existing WooCommerce orders. It accepts an order_id parameter and attempts to charge the supplied payment method against that order.
The handler enforces only a nonce check. The required nonce is rendered into the page markup on any WooCommerce front-end view where Express Checkout is enabled, making it accessible to any unauthenticated visitor. The function never compares the requesting session against the order owner and never validates the WooCommerce order_key query parameter that normally gates anonymous access to a single order.
With a valid nonce in hand, an attacker iterates through sequential order IDs and submits a malformed payment method. Stripe rejects the payment and the plugin catches the exception, updating the target order to failed. The result is an unauthenticated order-status tampering primitive against every pending order on the site.
Root Cause
The root cause is a missing capability and ownership check [CWE-862]. The handler trusts the nonce as a sufficient authorization gate, conflating CSRF protection with access control. Order endpoints in WooCommerce normally require the secret order_key to be matched against the order, but ajax_pay_for_order() omits that verification entirely.
Attack Vector
The attack requires only network access to the WooCommerce storefront. The attacker fetches a page that exposes the Express Checkout nonce, then issues authenticated AJAX requests to wc_stripe_pay_for_order while enumerating order_id values. Each request carrying an invalid payment method transitions one order to failed. See the CleanTalk CVE-2026-2381 Analysis and the Wordfence Threat Intelligence advisory for the technical breakdown.
No verified exploit code is published for this CVE. Reference the vulnerable handler source and the fix in changeset 3564842 for implementation specifics.
Detection Methods for CVE-2026-2381
Indicators of Compromise
- Bursts of POST requests to /?wc-ajax=wc_stripe_pay_for_order from a single IP or user agent with no preceding cart or checkout activity
- Sequential or rapidly incrementing order_id values in WC-AJAX request bodies
- WooCommerce order notes recording payment exceptions and a status change to failed for orders that customers did not interact with
- Abnormal spikes in Stripe API declines or payment method validation errors tied to the same nonce
Detection Strategies
- Parse web server access logs for high-frequency calls to the wc_stripe_pay_for_order endpoint and correlate with order status transitions in the WooCommerce database.
- Alert when the _failed order status meta is set without a preceding authenticated session belonging to the order's customer ID.
- Hunt for unauthenticated POSTs that include a valid _wpnonce but originate from IPs that never loaded a checkout page belonging to the targeted order.
Monitoring Recommendations
- Enable WooCommerce order audit logging and ship events to a centralized SIEM for correlation with web access logs.
- Track the rate of pending to failed order transitions per hour and alert on deviations from baseline.
- Monitor Stripe Dashboard for unusual declines tied to the WC-AJAX endpoint, particularly when paired with non-customer IP addresses.
How to Mitigate CVE-2026-2381
Immediate Actions Required
- Update the WooCommerce Stripe Payment Gateway plugin to version 10.8.0 or later on every WordPress site that runs it.
- Audit recent failed order transitions and restore legitimate orders that were tampered with prior to patching.
- Restrict access to /?wc-ajax=wc_stripe_pay_for_order at the WAF layer until the patch is deployed, allowing only requests carrying a valid customer session cookie.
Patch Information
The vendor remediated the issue in WooCommerce Stripe Payment Gateway 10.8.0. The fix is documented in changeset 3564842 and the 10.7.0 to 10.8.0 diff. The patch adds an order ownership and order_key verification step before processing the payment retry.
Workarounds
- Disable Stripe Express Checkout on the storefront until the plugin can be upgraded, which removes the publicly rendered nonce that enables the attack.
- Add a WAF rule that blocks unauthenticated POST requests to wc-ajax=wc_stripe_pay_for_order lacking a session cookie tied to the order owner.
- Apply rate limiting on the WC-AJAX endpoint to slow enumeration of sequential order IDs.
# Example WP-CLI update command for affected sites
wp plugin update woocommerce-gateway-stripe --version=10.8.0
wp plugin get woocommerce-gateway-stripe --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
