CVE-2026-2381

The WooCommerce Stripe Payment Gateway plugin for WordPress contains a vulnerability that allows unauthorized modification of order data. Specifically, the plugin's `ajax_pay_for_order()` function does not properly verify the requesting user's ownership of the target order, allowing an attacker to manipulate an order's status by providing a fake payment method. This can be exploited to force a pending order into a failed status by sequentially enumerating order IDs, resulting in a payment exception that updates the order status.

Based on public CVE data (MITRE/NVD).