CVE-2026-80339: CWE-200 Information Exposure in Payment Plugins for Stripe WooCommerce
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
AI Analysis
Technical Summary
Payment Plugins for Stripe WooCommerce before version 4.0.12 does not validate the order key before embedding order data into the JavaScript configuration on the front end. This flaw allows unauthenticated attackers to iterate through sequential order identifiers and obtain billing details and the secret that controls access to this information. The vulnerability is classified as CWE-200 (Information Exposure). No CVSS score or official patch information is currently available.
Potential Impact
Unauthenticated attackers can access sensitive billing details of any order by enumerating order IDs, potentially leading to exposure of customer personal and payment information. This compromises customer privacy and could facilitate further attacks or fraud. There is no indication of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to order information and monitor for suspicious activity related to order enumeration. Avoid using version 4.0.0 in production environments if possible.
CVE-2026-80339: CWE-200 Information Exposure in Payment Plugins for Stripe WooCommerce
Description
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Payment Plugins for Stripe WooCommerce before version 4.0.12 does not validate the order key before embedding order data into the JavaScript configuration on the front end. This flaw allows unauthenticated attackers to iterate through sequential order identifiers and obtain billing details and the secret that controls access to this information. The vulnerability is classified as CWE-200 (Information Exposure). No CVSS score or official patch information is currently available.
Potential Impact
Unauthenticated attackers can access sensitive billing details of any order by enumerating order IDs, potentially leading to exposure of customer personal and payment information. This compromises customer privacy and could facilitate further attacks or fraud. There is no indication of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to order information and monitor for suspicious activity related to order enumeration. Avoid using version 4.0.0 in production environments if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-26T09:19:33.772Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa0f7c1acd9273b49d85720
Added to database: 09/09/2026, 06:08:01 UTC
Last enriched: 09/09/2026, 06:23:48 UTC
Last updated: 09/09/2026, 23:25:23 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.