CVE-2024-0705 is a critical SQL injection in the Stripe Payment Plugin for WooCommerce, scored 9.8, in all versions up to and including 3.7.9. No login is needed. Update the plugin to a release newer than 3.7.9 and review the site for signs of data access.
What's affected
The record says the Stripe Payment Plugin for WooCommerce plugin for WordPress is affected in all versions up to and including 3.7.9. I could not retrieve the vendor changeset or advisory pages, so a fixed version is not confirmed here. The record says all versions up to and including 3.7.9 are affected, which implies a later release carries the fix. Check the plugin changelog on WordPress.org and the Wordfence entry before you rely on a specific number.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: reachable over the network, low complexity, no privileges, no user interaction, and high impact across the board. The vendor in the product data is WebToffee. The weakness class is CWE-89.
How to check if you're exposed
If you have WP-CLI access, list installed plugins and their versions:
wp plugin list --fields=name,version,status,update
Look for the payment-gateway-stripe-and-woocommerce-integration row. If the version is 3.7.9 or lower, you are in the affected range. You can also open Plugins in the WordPress admin and read the version under the plugin name.
To update from the command line:
wp plugin update payment-gateway-stripe-and-woocommerce-integration
Deactivated plugins still sit on disk and in some cases can still be reached by URL, so check inactive ones too.
What to do now
- Check the installed version of the plugin on every WordPress site you run, including staging copies.
- Update to the latest release and confirm in the changelog that the issue is addressed.
- If you cannot update right away, deactivate the plugin until you can, or restrict access with your web application firewall.
- Review access logs and the database for unexpected activity if the site was exposed for a long period.
- Add the plugin to the list you watch for new advisories.
Why it matters
The id parameter is not escaped enough, and the existing query is not prepared. The record says unauthenticated attackers can append extra SQL to the query and extract sensitive information from the database.
On a store, the database holds customer names, addresses, order history and sometimes API keys in options tables. Even when card data stays with Stripe, the rest of that record set is valuable and regulated. A parameter that reaches a query without binding is the textbook case for prepared statements, which separate query structure from data and make this class of bug disappear.
Treat any e-commerce site that ran an affected version on the public internet as a candidate for a log review after you patch.
The record does not mark this CVE as known exploited, and no advisory I fetched says it is. Plugin flaws like this are still scanned for in bulk once they are public, so patch windows matter more than the exact score.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this expose card numbers?
The record describes extracting sensitive information from the database. It does not say card numbers are stored there, and payment processors generally keep them off the shop server.
Do I need to be logged in to exploit it?
No. The record says unauthenticated attackers can.
Sources
Last reviewed: 19 October 2026.
