Is CVE-2026-59530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59530 being exploited in the wild.

How severe is CVE-2026-59530?

High severity, with a CVSS score of 7.5, published 27 July 2026.

Which products and versions are affected?

Payment Plugins Stripe For WooCommerce <= 4.0.7.

Is there a fix for CVE-2026-59530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59530 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59530?

Check whether you run Payment Plugins Stripe For WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59530: Payment Plugins Stripe For WooCommerce broken access control

Q: Is there a fix for CVE-2026-59530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-59530 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59530?

Check whether you run Payment Plugins Stripe For WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59530 · Severity: high · CVSS 7.5 · Published 2026-07-27

The Stripe For WooCommerce plugin, which enables WordPress sites to accept payments via Stripe, contains a security flaw that allows unauthorized individuals to perform actions they should not have access to. This could potentially allow an attacker to interfere with payment processing or modify order-related data without needing to log in. Such an exploit could disrupt business operations and impact the integrity of transaction records.

Vendors: Payment Plugins.

Quick answers

Is CVE-2026-59530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59530 being exploited in the wild.
How severe is CVE-2026-59530?: High severity, with a CVSS score of 7.5, published 27 July 2026.
Which products and versions are affected?: Payment Plugins Stripe For WooCommerce <= 4.0.7.
Is there a fix for CVE-2026-59530?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59530 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59530?: Check whether you run Payment Plugins Stripe For WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Stripe For WooCommerce plugin (woo-stripe-payment) for WordPress is vulnerable to broken access control due to missing authorization checks (CWE-862) in versions up to 4.0.7. This vulnerability allows an unauthenticated remote attacker to execute functions that should be restricted to higher-privileged users. According to the CVSS vector, the primary impact is on data integrity, suggesting that an attacker could modify information without authorization. The issue is resolved in version 4.0.8.

Affected products

Payment Plugins Stripe For WooCommerce <= 4.0.7

Timeline

2026-02-22: other: Reported by researcher timomangcut
2026-07-23: advisory: Patchstack published advisory
2026-07-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.