CVE-2021-39347: paymentplugins stripe for woocommerce

csirt@kutim:~/threat-intel/cve/CVE-2021-39347

CVSS 4.3 · Medium EPSS 0,67%

Kerentanan Missing Authorization pada paymentplugins stripe for woocommerce. Skor CVSS 3.1 4.3 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.

Rincian

Terbit di NVD: 4 Oktober 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,67% peluang dieksploitasi; lebih tinggi dari 50,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
paymentplugins	stripe for woocommerce	Versi 3.0.0 hingga 3.3.9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://plugins.trac.wordpress.org/changeset/2601162/woo-stripe-payment/trunk/includes/admin/class-wc-stripe-a... patch · advisory pihak ketiga
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.