¿Es seguro Woocommerce Gateway Stripe?

Qué hace este plugin

• Slug: woocommerce-gateway-stripe
• 700000+ instalaciones activas

credit cardpaymentsstripewoowoocommerce

Estado de mantenimiento

• Última versión conocida: 10.8.4
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Woocommerce Gateway Stripe. Reportadas entre 2023 y 2026.

CVE-2026-2381

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-51502

Update the WordPress WooCommerce Stripe Payment Gateway plugin to the latest available version (at least 7.6.2). Rafie Muhammad (Patchstack) discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress WooCommerce Stripe Payment Gateway Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has been fixed in version 7.6.2. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-44999

Update the WordPress WooCommerce Stripe Payment Gateway plugin to the latest available version (at least 7.6.1). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WooCommerce Stripe Payment Gateway Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 7.6.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WooCommerce Stripe Payment Gateway [woocommerce-gateway-stripe] < 7.6.1

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 7.6.1 (exclusive). This is due to missing or incorrect nonce validation on the maybe_handle_redirect function. This makes it possible for unauthenticated attackers to change the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-34000

Update the WordPress WooCommerce Stripe Payment Gateway plugin to the latest available version (at least 7.4.1). Rafie Muhammad (Patchstack) discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress WooCommerce Stripe Payment Gateway Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has been fixed in version 7.4.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-35049

Update the WordPress WooCommerce Stripe Payment Gateway plugin to the latest available version (at least 7.4.1). Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress WooCommerce Stripe Payment Gateway Plugin. This vulnerability has been fixed in version 7.4.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Cómo solucionarlo

Mantén Woocommerce Gateway Stripe actualizado — 10.8.4 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WooPayments: Integrated WooCommerce Payments — 900000+ instalaciones activas — 66/100 (160) — PHP máx. 8.4
• WooCommerce PayPal Payments — 800000+ instalaciones activas — 56/100 (567) — PHP máx. 8.4
• Payment Plugins for Stripe WooCommerce — 100000+ instalaciones activas — 96/100 (297) — PHP máx. 8.4
• Mollie Payments for WooCommerce — 100000+ instalaciones activas — 70/100 (69)
• Razorpay for WooCommerce — 100000+ instalaciones activas — 50/100 (23)