{"id":18098,"date":"2023-06-16T11:40:00","date_gmt":"2023-06-16T11:40:00","guid":{"rendered":"https:\/\/www.searchenginejournal.com\/vulnerability-in-woocommerce-stripe-payment-gateway-plugin-affects-900000-websites\/489427\/"},"modified":"2023-06-16T11:40:00","modified_gmt":"2023-06-16T11:40:00","slug":"vulnerability-in-woocommerce-stripe-payment-gateway-plugin-affects-900000-websites-via-sejournal-martinibuster","status":"publish","type":"post","link":"https:\/\/marketingnewsbox.com\/?p=18098","title":{"rendered":"Vulnerability In WooCommerce Stripe Payment Gateway Plugin Affects 900,000+ Websites via @sejournal, @martinibuster"},"content":{"rendered":"
<\/div>\n

The WooCommerce Stripe payment gateway plugin was discovered to have a vulnerability that allows an attacker to steal customer personally identifiable information (PII) from stores using the plugin.<\/p>\n

Security researchers warn that hackers do not need authentication to pull off the exploit, which received a rating of high, 7.5 on a scale of 1 \u2013 10.<\/p>\n

WooCommerce Stripe Payment Gateway Plugin<\/h2>\n

The Stripe payment gateway plugin, developed by WooCommerce, Automattic, WooThemes and other contributors, is installed in over 900,000 websites.<\/p>\n

It offers an easy way for customers at WooCommerce stores to checkout, with a number of different credit cards and without having to open an account.<\/p>\n

A Stripe account is automatically created at checkout, providing customers with a frictionless ecommerce shopping experience.<\/p>\n

The plugin works through an application programming interface (API ).<\/p>\n

An API is like a bridge between two software that allows the WooCommerce store to interact with the Stripe software to process orders from the website to Stripe seamlessly.<\/p>\n

What is the Vulnerability in WooCommerce Stripe Plugin?<\/h2>\n

Security researchers at Patchstack discovered the vulnerability and responsibly disclosed it to the relevant parties.<\/p>\n

According to security researchers at Patchstack:<\/strong><\/p>\n

\n

\u201cThis plugin suffers from an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability.<\/p>\n

This vulnerability allows any unauthenticated user to view any WooCommerce order\u2019s PII data including email, user\u2019s name, and full address.\u201d<\/p>\n<\/blockquote>\n

WooCommerce Stripe Plugin Versions Affected<\/h2>\n

The vulnerability affects versions prior to and equal to version 7.4.0.<\/p>\n

Developers associated with the plugin updated it to version 7.4.1, which is the most secure version.<\/p>\n

These were the security updates made, according to the official plugin changelog<\/a>:<\/strong><\/p>\n

\n