CVE-2026-80339: Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Payment Plugins for Stripe WooCommerceto a version that resolves this vulnerability.Fixed in 4.0.12 - Compensating control
Restrict public access to the WordPress order-pay endpoint (e.g., block/ACL the route used for order payments) to prevent unauthenticated users from iterating order identifiers until the plugin is upgraded.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can exploit it. The attacker can iterate sequential order identifiers to retrieve billing details from orders.
What does an attacker need to obtain order data?
The attacker needs an order identifier to access an order-pay page. Because the plugin does not validate the order key before exposing data in front-end JavaScript, the order key is not required as a valid access-control credential.
Which information may be exposed?
The issue exposes billing details for affected orders and the secret that gates access to those details.
How can I tell whether my site is affected?
Sites using Payment Plugins for Stripe WooCommerce versions earlier than 4.0.12 are affected. The exposure can be observed on order-pay pages, where order data is added to the front-end JavaScript configuration without validating the order key.