Executive brief
The Accept Stripe Payments WordPress plugin fails to validate which product a customer receives after completing payment, allowing attackers to pay for one product but receive fulfillment for a different, lower-priced item. An attacker who completes a legitimate payment can modify the order to claim any product priced at or below what they paid for, redirecting stock and digital fulfillment (downloads, licenses) to a different product while the legitimate payment intent remains intact.
Technical details
The plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in its checkout confirmation logic. When processing payment completion, the plugin verifies only that the payment amount is at least equal to the target product's price, but does not validate that the product ID in the final confirmation request matches the product ID from the original payment authorization. An unauthenticated attacker can obtain the universal, product-independent form nonce, complete a genuine payment for Product A, then replay the confirmation request with the same valid PaymentIntent ID but substitute a different product ID (Product B), gaining fulfillment for Product B if its price is ≤ the amount paid. The vulnerability is fixed in version 2.1.4.
Affected products
- WordPress Accept Stripe Payments before 2.1.4
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 2.1.4