b2b-daily
Home | IT | Cyber Security

WordPress Stripe Payment Gateway Plugin Leaves Nearly 900,000 Installations Worldwide Vulnerable to IDOR Attack

Avatar photo
by Craig Anderson
June 15, 2023
Image Credit: Adobe Stock
WordPress Stripe Payment Gateway Plugin Leaves Nearly 900,000 Installations Worldwide Vulnerable to IDOR Attack

WordPress is one of the most popular website builders that provides individuals and businesses with a platform for creating their own websites. The platform offers various themes, plugins, and features that can be added to a website to enhance its functionality and design. One such plugin is the WooCommerce Stripe Gateway Plugin, which allows users to keep customers on their WordPress site during payment. Unfortunately, this plugin has a vulnerability that exposes nearly 900,000 installations worldwide to an unauthenticated insecure direct object reference (IDOR) attack.

Vulnerability Description: Unauthenticated Insecure Direct Object Reference (IDOR) in WordPress Stripe Payment Gateway Plugin

Insecure Direct Object Reference (IDOR) is a security flaw in an application that occurs when the application exposes a reference to an internal object in such a way that attackers can manipulate the object. In the case of the WordPress Stripe Payment Gateway Plugin, a vulnerability was discovered that allows an attacker to retrieve sensitive information from the database without proper authentication.

Plugin Information: Version 7.4.1 and 900K Installations Worldwide

The WordPress Stripe Payment Gateway Plugin is a popular plugin used by nearly 900,000 installations worldwide. The plugin version that is vulnerable to the IDOR attack is 7.4.0 and below. It is essential to note that the vulnerability was discovered in version 7.4.0 and is not present in higher versions of the plugin.

The purpose of using the WooCommerce Stripe Gateway Plugin is to keep customers on the WordPress site during the payment process. This is achieved by providing a secure payment gateway that prevents customers from being redirected to third-party sites, offering a seamless and effortless shopping experience.

Exploitation Method: Retrieving Sensitive Information from Database using javascript_params and payment_fields function

The vulnerability in the WooCommerce Stripe Gateway Plugin is caused by a flaw in the javascript_params and payment_fields function. An attacker can exploit these functions to retrieve sensitive information from the database. Since this vulnerability can be exploited without authentication, it poses a severe risk.

Severity Level: Exposure of Sensitive Data is Considered Serious and may Lead to More Attacks

Exposure of the above data is considered serious. Once sensitive information, such as credit card numbers, is retrieved by an attacker, it can be used to conduct fraudulent activities and compromise the security of online transactions. The vulnerability can lead to more attacks if not addressed promptly.

Affected Product: WordPress Stripe Gateway Plugin Version 7.4.0 and Below

The vulnerability exists in the WordPress Stripe Gateway Plugin version 7.4.0 and below. Hence, users who have installed this version or below are at risk of being compromised.

Solution available

Fixed in Version 7.4.1. The necessary updates to address this flaw have been made available by WooCommerce. The vulnerability has been fixed in version 7.4.1. Users are advised to upgrade to version 7.4.1, which addresses this flaw.

WordPress has responded to the vulnerability by releasing version 7.4.1, which fixes the flaw. The company has also advised users to upgrade to the latest version to ensure the security of their online transactions.

Statistics

More than half of all active plugin installations use a vulnerable version, according to statistics compiled by WordPress.org. This indicates that the majority of users are at risk and must update their plugin immediately.

To conclude, the WordPress Stripe Gateway Plugin has a vulnerability that exposes nearly 900K installations worldwide to an Unauthenticated Insecure Direct Object Reference (IDOR) attack. The flaw exists in version 7.4.0 and below. It is recommended that users upgrade to version 7.4.1 to address this issue. Failure to update the plugin exposes users to the risk of sensitive information being accessed by an attacker, leading to fraudulent activities and compromise of online transactions. Keeping your WordPress plugins up-to-date is essential to ensuring the security of your website and preventing vulnerabilities from being exploited.

Digital TransformationInformation Security

Explore more

How Does CryptoBandits Steal Your Crypto via USB?
June 25, 2026

The seemingly innocuous act of inserting a flash drive into a workstation often serves as the silent catalyst for a devastating breach that can drain a digital wallet in seconds without triggering traditional antivirus alarms. This physical threat vector, utilized by the group known as CryptoBandits, exploits the inherent trust users place in hardware devices. While most cybersecurity discussions in

How Does the Klue Breach Expose Supply Chain Risks?
June 25, 2026

Introduction Modern digital ecosystems rely on a delicate web of trust that, when broken by a single compromised credential, can trigger a domino effect across the world’s most sophisticated cybersecurity firms. This reality became starkly evident when Klue, a prominent business intelligence provider, experienced a significant security failure within its integration architecture. The event serves as a masterclass in how

Trend Analysis: EDR Evasion in Ransomware
June 25, 2026

Digital adversaries have abandoned simple stealth in favor of an aggressive scorched-earth policy that systematically dismantles security defenses before a single byte of data is encrypted. This tactical evolution marks a significant departure from traditional malware behavior. As organizations deploy robust Endpoint Detection and Response (EDR) systems, operators have responded with security-killer frameworks operating within the system kernel. The significance

Is Traditional IAM Enough for the New Era of Agentic AI?
June 25, 2026

Dominic Jainy is a seasoned IT architect who has spent the better part of two decades navigating the complex intersection of artificial intelligence, machine learning, and blockchain technology. As organizations rush to integrate autonomous systems into their daily operations, Jainy has emerged as a vital voice in the conversation regarding how we secure these “digital employees.” His expertise is not

Data Centers Adopt New Strategies to Address Public Backlash
June 25, 2026

The unprecedented acceleration of global digital infrastructure has forced data center developers to confront a significant barrier of community opposition that technical expertise alone cannot overcome. For several decades, these facilities operated largely in the shadows, serving as the invisible architecture of the internet while hidden away in industrial parks or rural outskirts. However, the surge in generative artificial intelligence