CVE-2026-80339 Overview
CVE-2026-80339 affects the Payment Plugins for Stripe WooCommerce WordPress plugin in versions before 4.0.12. The plugin adds order data to a JavaScript configuration object rendered on the front end without validating the order key. Unauthenticated attackers can iterate sequential order identifiers to retrieve billing details and the secret that gates access to each order. The flaw is classified as an information exposure issue [CWE-200] and carries a network attack vector with no authentication or user interaction required.
Critical Impact
Unauthenticated remote attackers can enumerate customer billing details and per-order access secrets from any WooCommerce store running an affected version of the plugin.
Affected Products
- Payment Plugins for Stripe WooCommerce WordPress plugin versions prior to 4.0.12
- WordPress sites running WooCommerce with the vulnerable plugin installed
- Any deployment exposing checkout or order-related front-end pages to unauthenticated visitors
Discovery Timeline
- 2026-09-09 - CVE-2026-80339 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-80339
Vulnerability Analysis
The plugin injects order-specific data into a JavaScript configuration block rendered on the front end. Order identifiers in WooCommerce are sequential integers, making enumeration trivial. Because the plugin does not verify the caller possesses the correct order key before emitting this configuration, any unauthenticated visitor can request order-related pages and harvest sensitive billing information. The exposed payload also includes the secret that normally gates access to the order, defeating the key-based authorization model WooCommerce uses to protect order views.
The issue falls under the Information Disclosure category. Exploitation impacts confidentiality only; integrity and availability are not affected. Refer to the WPScan Vulnerability Advisory for the advisory record.
Root Cause
The plugin fails to validate the order key parameter before including order data in the JavaScript configuration output. Authorization checks are missing at the point where sensitive fields are serialized into the page. This is a broken access control condition combined with sensitive data exposure.
Attack Vector
An attacker sends unauthenticated HTTP requests to pages that trigger the plugin's front-end configuration output. By iterating order identifiers sequentially, the attacker enumerates every order on the store. Each response contains billing details and the order's secret, which can then be reused to access the underlying order resources directly. No authentication, user interaction, or elevated privileges are required.
No public exploit code or proof-of-concept has been published for this issue. Technical details are documented in the WPScan Vulnerability Advisory.
Detection Methods for CVE-2026-80339
Indicators of Compromise
- Sequential, high-volume requests to WooCommerce order or checkout endpoints from a single source IP or small set of IPs
- Unauthenticated GET requests iterating numeric order_id or order-received values in rapid succession
- Unusual outbound scraping patterns in web server access logs targeting Stripe-integrated checkout pages
Detection Strategies
- Inventory WordPress sites and identify installations of the Payment Plugins for Stripe WooCommerce plugin below version 4.0.12
- Review web server access logs for enumeration patterns against order URLs, especially requests without valid session cookies
- Correlate spikes in front-end order page requests with the absence of matching checkout completions
Monitoring Recommendations
- Enable rate limiting and anomaly detection on order-related URL paths at the web application firewall
- Alert on unauthenticated access to order pages that returns HTTP 200 responses in high volume
- Retain access logs long enough to support retrospective analysis of possible prior enumeration
How to Mitigate CVE-2026-80339
Immediate Actions Required
- Upgrade the Payment Plugins for Stripe WooCommerce plugin to version 4.0.12 or later on all affected WordPress sites
- Audit web server logs for evidence of order enumeration prior to patching
- Notify affected customers if log review indicates their billing details were retrieved
Patch Information
The vendor addressed the issue in version 4.0.12 of the plugin by validating the order key before emitting order data in the front-end JavaScript configuration. Site administrators should update through the WordPress plugin management interface or by deploying the updated plugin package. Details are available in the WPScan Vulnerability Advisory.
Workarounds
- Deactivate the plugin until it can be upgraded if immediate patching is not possible
- Deploy web application firewall rules that require a valid order key parameter on order-related endpoints
- Apply rate limiting to unauthenticated requests targeting order pages to slow enumeration
# Example WP-CLI command to update the affected plugin
wp plugin update woo-stripe-payment --version=4.0.12
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
