A security flaw has been discovered in the WooCommerce Stripe Gateway WordPress plugin that may lead to unauthorized disclosure of sensitive information.
Defects are tracked as CVE-2023-34000, affecting versions 7.4.0 and below. This issue has been addressed by the plugin maintainers in version 7.4.1, which shipped on May 30, 2023.
WooCommerce Stripe Gateway allows e-commerce websites to accept a variety of payment methods directly through Stripe’s payment processing API. It boasts over 900,000 active installations.
According to Patch security researcher Rafie Muhammad, the plugin has a so-called “Unauthenticated Insecure Direct Object Reference (IDOR)” vulnerability that allows malicious attackers to bypass authentication. to access the resource.
In particular, the issue is due to insecure handling of order objects and lack of proper access control mechanisms in the plugin’s ‘javascript_params’ and ‘payment_fields’ functions.
“This vulnerability allows unauthenticated users to view PII data for WooCommnerce orders, including email, username and full address,” Muhammad said.
This development comes a few weeks after the WordPress core team released 6.2.1 and 6.2.2 to address five security issues, among them an unauthenticated directory traversal vulnerability and It contains unauthenticated cross-site scripting flaws, three of which were discovered during a third-party security audit. .
