CVE-2024-0705: SQL Injection in Stripe Payment Plugin

The SQL Injection vulnerability in the Stripe Payment Plugin for WooCommerce allows attackers to manipulate database queries. By injecting malicious SQL code through the 'id' parameter, an attacker can bypass security measures and directly access sensitive information stored within the WordPress database. This could include customer data (names, addresses, payment details), order information, and potentially even administrative credentials. Successful exploitation could lead to data breaches, financial fraud, and complete compromise of the WooCommerce store. The impact is particularly severe given the plugin's widespread use for processing payments, making it a prime target for malicious actors.

1. Reserved2024-01-18
2. Published2024-01-19
3. Modified2024-10-21
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-0705 is to immediately upgrade the Stripe Payment Plugin for WooCommerce to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to filter SQL injection attempts targeting the 'id' parameter can provide an additional layer of defense. Regularly review WordPress and plugin configurations for any unusual activity or suspicious modifications. After upgrading, confirm the fix by attempting a SQL injection payload through the 'id' parameter and verifying that it is properly sanitized.

Active installs

8KKnown

Plugin rating

4.4

Requires WordPress

5.6+

Compatible up to

6.9.4

Requires PHP

5.6+