CVE-2023-51502 is an authorization bypass through a user-controlled key, an insecure direct object reference in the WooCommerce Stripe Payment Gateway plugin by WooCommerce, rated High (7.5). It affects versions up to and including 7.6.1. Update to the latest release and confirm the fixed version in the vendor advisory.
What's affected
The NVD record names WooCommerce Stripe Payment Gateway by WooCommerce and lists versions up to and including 7.6.1.
| Item | Detail |
|---|---|
| Product | WooCommerce Stripe Payment Gateway (WordPress plugin) |
| Affected | versions up to and including 7.6.1 |
| Fixed | not confirmed in the sources I could reach |
| CVSS | 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Weakness | CWE-639 (Authorization Bypass Through User-Controlled Key) |
| Published | 2024-01-05 |
The record's CISA Known Exploited Vulnerabilities flag is false for this CVE.
The record states the last affected version but gives no fixed version, and the Patchstack page named in the record returned an access error when I tried to fetch it, so I cannot confirm the patched release. Check the plugin changelog on WordPress.org or the vendor advisory.
How to check if you're exposed
If you manage the site with WP-CLI, list the installed version and whether an update is waiting:
wp plugin list --fields=name,status,version,update_version | grep woocommerce-gateway-stripe
You can also open Plugins in the WordPress dashboard and read the version under the plugin name. Compare it with the affected range above. If you run many sites, export an inventory of plugins and versions from each one and compare them in one pass. The free scanner at gold.safeguard.sh/scan can check a dependency manifest in the browser, and the Gold directory lists known issues by component.
Also check staging copies and sites that were cloned from older backups. Inactive plugins still sit on disk and some of them still expose files, so remove plugins you no longer use rather than only deactivating them.
What to do now
- Update WooCommerce Stripe Payment Gateway to the latest release. The record gives only the last affected version, and the Patchstack page could not be retrieved for this review, so check the vendor changelog or advisory to confirm which release contains the fix.
- Run the update on staging first if the plugin is business critical, then roll it out to production.
- Re-run the WP-CLI check above on every site you manage and confirm no copy remains in the affected range.
- Remove the plugin if you no longer need it, instead of leaving it deactivated.
- Review administrator accounts and recent changes on any site that ran an affected version while exposed to the internet.
Why it matters
The record classifies this as CWE-639 (Authorization Bypass Through User-Controlled Key).
An insecure direct object reference means the plugin uses an identifier that the client supplies, such as an order or payment reference, to find a record, and does not confirm the caller owns it. Change the identifier and you reach someone else's record.
For a payment gateway this class is sensitive because the records involved relate to orders and payments. The record rates the impact as high integrity with no confidentiality or availability loss, so the concern is unwanted changes to data that the plugin manages.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this expose card numbers?
The record does not say that. It rates integrity as high and confidentiality as none. Check the vendor advisory for the exact effect before you tell anyone more than that.
How do I know which version is fixed?
Use the version stated under What is affected, and confirm it against the vendor changelog or advisory linked in Sources before you close the ticket.
Sources
- NVD record data for CVE-2023-51502 via Safeguard Gold
- Patchstack advisory (listed in the NVD record, could not be retrieved)
Last reviewed: 19 October 2026.
