A critical broken access control vulnerability in the Stripe For WooCommerce plugin permits unauthenticated attackers to potentially modify store settings or perform unauthorized operations.

The plugin contains a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to perform actions that should be restricted to authorized users. This flaw bypasses necessary capability checks, leading to potential integrity compromises within the payment configuration.

This vulnerability allows an attacker to manipulate payment settings or integrity, which poses a direct risk to financial transactions and store operations. With a CVSS score of 7.5, the risk to the integrity of the payment processing environment is high, potentially leading to financial discrepancies or service disruption.

Immediate Action: Update the WordPress Stripe For WooCommerce plugin to version 4.0.8 or later to remediate the broken access control flaw.

Proactive Monitoring: Review application logs for unauthorized changes to payment settings or unexpected administrative activity during off-hours.

Compensating Controls: Apply WAF rules to restrict access to sensitive plugin endpoints, ensuring that only authenticated administrative traffic is permitted to interact with payment configuration functions.

Public Exploit Available: No

The severity and potential for integrity loss within the payment workflow demand immediate action. It is critical to apply the provided patch as soon as possible to ensure that payment settings remain secure and protected from unauthorized modification.