CVE-2021-39347 Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking
Attackers can hijack financial accounts by modifying Stripe settings due to missing capability checks in the admin user edit function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39347?
CVE-2021-39347 is a medium-severity missing authorization vulnerability in Stripe for WooCommerce, published on 4 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
Weakness: CWE-862
Which versions are affected by CVE-2021-39347?
It affects 1 product.
Products include Paymentplugins Stripe for Woocommerce.
How do I fix CVE-2021-39347?
No fix has been published for CVE-2021-39347 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-39347 being exploited?
There is no known exploitation of CVE-2021-39347 in the wild and no public exploit code.
Sources
Also known as GHSA-jv5v-gch6-hq4m.