On June 8, 2023, the Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in WebToffee’s Stripe Payment Plugin for WooCommerce plugin, which is actively installed on more than 10,000 WordPress websites. This vulnerability makes it possible for an attacker to gain access to the accounts of users who have orders. These users are typically customers but can include other high-level users when the right conditions are met.
All WordFence users received a firewall rule to protect against any exploits targeting this vulnerability on by July 19, 2023.
WordFence contacted WebToffee on June 8, 2023, and received a response the next day. After providing full disclosure details, the developer released a patch on June 13, 2023. We would like to commend the WebToffee development team for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of Stripe Payment Plugin for WooCommerce, version 3.7.8 at the time of this writing, as soon as possible.