CVE-2024-43316 MEDIUM

CVE-2024-43316: WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Checkout Plugins
Product Stripe Payments For WooCommerce by Checkout
Weakness CWE-352 · CSRF
Published August 26, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.

Explanation of Vulnerability in Simple Terms

02Summary

The Stripe Payments For WooCommerce plugin through version 1.9.1 is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or page that, when visited by a site administrator, performs unwanted actions on the Stripe payment configuration without the administrator's knowledge or consent. This could allow modification of payment settings or other administrative functions.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions on Stripe payment settings by tricking an admin into visiting a malicious page.

Potential impact on your site

04Site Impact

Payment configuration could be altered without your knowledge if you visit a malicious link while logged in.

Conditions required to exploit

05Prerequisites

Admin must visit a malicious link or page; no authentication bypass needed.

Key dates

06Disclosure timeline

August 26, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9723 Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page CVE-2026-9730 Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update CVE-2026-11981 GiveWP <= 4.15.3 - Cross-Site Request Forgery CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-7047 Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action