Improper Authorization in Stripe For WooCommerce - CVE-2021-39347
Published: October 26, 2021
Vulnerability identifier: #VU57638
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-39347
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to missing a capability check on the "save()" function in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file. A remote authenticated attacker can configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts.
Affected software
Stripe For WooCommerce
How to mitigate CVE-2021-39347
Install updates from vendor's website.
Stripe For WooCommerce - update to 3.3.10