CVE-2026-80339: CWE-200 Information Exposure in Payment Plugins for Stripe WooCommerce
Affects Payment Plugins for Stripe WooCommerceSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 10/25/2026, 04:40:14 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Payment Plugins for Stripe WooCommerce | Affected
| Fixed in
|
AI-suggested
Until an official fix is released, restrict access to order information and monitor for suspicious activity related to order enumeration. Avoid using version 4.0.0 in production environments if possible.
Description
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
Impact
Unauthenticated attackers can access sensitive billing details of any order by enumerating order IDs, potentially leading to exposure of customer personal and payment information. This compromises customer privacy and could facilitate further attacks or fraud. There is no indication of active exploitation in the wild.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.