Vulnerability · Published Oct 4, 2021 · Assigned by Wordfence

CVE-2021-39347Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking

Medium 4.3

In plain English

A medium-severity missing authorization in Stripe for WooCommerce from Stripe for WooCommerce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.

Affected products (as reported)

Vendor	Product	Versions
Stripe for WooCommerce	Stripe for WooCommerce	3.0.0 - 3.3.9

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2601162/woo-stripe-payment/trunk/includes/admin/class-wc-stripe-admin-user-edit.php x_refsource_MISC