CoreCVE
Back

MEDIUM

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9

Published Aug 18, 2023

Description

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers to modify the order status of arbitrary WooCommerce orders.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Wordfence
Published Aug 18, 2023
Updated Feb 5, 2025
Reserved Aug 1, 2023
Link CVE-2023-4040

CISA Vulnrichment

Updated Feb 5, 2025

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2023-4040

Red Hat

No data

ENISA EUVD

Assigner Wordfence
Published Aug 18, 2023
Updated Feb 5, 2025
Link EUVD-2023-53932

GitHub

No data