CVE-2026-9618: PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.120.46. This is due to missing or incorrect nonce validation on the peachpaystripehandleadminactions function. This makes it possible for unauthenticated attackers to permanently delete all stored Stripe credentials — including publishable keys, secret keys, webhook secrets, and Apple Pay configuration — from the WordPress database, disabling Stripe payment processing for the store via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9618?
CVE-2026-9618 has a medium severity rating of 4.3.
What kind of vulnerability is CVE-2026-9618?
CVE-2026-9618 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the PeachPay plugin.
How do I fix CVE-2026-9618?
To fix CVE-2026-9618, update the PeachPay plugin to a version that includes proper nonce validation.
Who is affected by CVE-2026-9618?
All users of the PeachPay plugin for WooCommerce versions up to and including 1.120.46 are affected by CVE-2026-9618.
What is the impact of CVE-2026-9618?
The impact of CVE-2026-9618 can potentially allow an attacker to unlink a Stripe account via CSRF.