CVE-2023-35049 is a missing authorization flaw in the WooCommerce Stripe Payment Gateway plugin, scored 7.5 High. The record lists versions through 7.4.0 as affected, with no login needed. I could not confirm the fixed version, so check the changelog and update.
What's affected
The record says the issue affects WooCommerce Stripe Payment Gateway from an unspecified first version through 7.4.0. The Patchstack entry the record points to could not be fetched here, though its address describes an unauthenticated broken access control issue in version 7.4.0. No fixed version is named in the record.
The record's vector shows a network attack with no login, a high integrity impact and no effect on confidentiality or availability. Because the plugin handles payment flows, integrity matters: changes to orders or payment state are the kind of thing store owners care about.
How to check if you're exposed
Check the installed plugin version in the WordPress admin under Plugins, or from the command line with WP-CLI:
wp plugin list
wp plugin get woocommerce-gateway-stripe --field=version
If the version is at or below the last affected release in the record, treat the site as exposed until you confirm a fixed release. Also check your update log and any staging or multisite installs, since plugins are often forgotten on secondary sites.
What to do now
- Open the plugin's changelog in the WordPress directory or the vendor's site and find the release that fixes this issue. I could not confirm one, so do not skip this step.
- Update the plugin to the latest release, after a backup and a test on staging.
- If the plugin is unused, deactivate and delete it.
- Review site roles, and remove accounts that do not need to exist.
- Turn on automatic plugin updates where you can accept the risk of unattended changes.
Why it matters
Missing authorization means the code does not check that the caller is allowed to perform an action. For payment plugins, the actions at stake include order and payment state.
I am not describing the exact function, because the sources I could read do not. What the score tells you is that no account is needed and that integrity is the main impact. For an online shop that is reason enough to update on the day you see it.
The weakness classes involved are CWE-862 (Missing Authorization). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Severity and versions come from the record alone. I could not read the Patchstack page, so I cannot say whether it agrees. The record names no fixed version.
Try it yourself
A shop with a dozen plugins needs a way to see which ones carry known issues. This demo shows how vulnerability management keeps that list in one place.
Click through it at your own pace, or open it full screen.
Quick check
Does this put card numbers at risk?
The record's vector shows no confidentiality impact, only high integrity impact. It says nothing about card data, and Stripe tokenizes cards. Check the plugin changelog for specifics.
What do I do first?
Update the plugin to the latest release after a backup, and read its changelog for the fix.
Sources
Last reviewed: 19 October 2026.
