CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
Explanation of Vulnerability in Simple Terms
Stripe for WooCommerce versions 3.0.0 through 3.3.9 lack proper authorization checks on certain payment operations. A logged-in user with low privileges can modify payment settings or transaction data they should not have access to. The vulnerability requires an active user account but no special permissions. Update to a version newer than 3.3.9.
What an attacker can do
Modify payment settings or transaction records without proper authorization.
Potential impact on your site
Customers' payment data or transaction history could be altered by unauthorized users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
