Executive brief
The Payment Plugins for Stripe WooCommerce WordPress plugin fails to validate order identifiers, exposing customer billing information including name, email, phone, and address to unauthenticated attackers. By guessing sequential order IDs, an attacker can harvest sensitive customer data and obtain order keys that grant access to complete customer order details without any authentication or authorization.
Technical details
The plugin outputs order data (including billing address and order key) into JavaScript configuration on the order-pay page without validating the order key parameter beforehand. An unauthenticated attacker can request the order-pay endpoint with sequential order IDs to harvest billing details from the page source, even though the frontend displays a validation error. The order key disclosed in this manner is the authentication token WooCommerce uses to gate access to the complete order view, allowing the attacker to view full customer data including shipping addresses. The vulnerability requires no authentication, no cookies, and no Stripe API keys—only network access to a WooCommerce store running the vulnerable plugin version. The issue was patched in version 4.0.12.
Affected products
- WC Beacon Payment Plugins for Stripe WooCommerce before 4.0.12
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 4.0.12