CVE-2023-4040

MediumCVSS 5.3

Published: 18/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

30th percentile - higher than 30% of all known CVEs

Summary

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to and including 3.7.9. This allows unauthenticated attackers to modify the order status of arbitrary WooCommerce orders.

Risk Assessment

The organization may be exposed to order manipulation, potentially leading to financial losses and loss of customer trust.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures to protect order data.

Original NVD description (English source)

The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to, and including, 3.7.9. This makes it possible for unauthenticated attackers to modify the order status of arbitrary WooCommerce orders.