Cette page n'a pas encore été traduite dans votre langue. Affichage du contenu en anglais pendant que nous y travaillons.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2025-49302: RCE in Easy Stripe Payment Gateway
traduction en cours…Plateforme
wordpress
Composant
easy-stripe
Corrigé dans
1.1.1
CVE-2025-49302 describes a Remote Code Execution (RCE) vulnerability within the Easy Stripe payment gateway. This flaw, stemming from improper code generation control (code injection), allows attackers to include arbitrary code, potentially granting them complete control over affected systems. The vulnerability impacts Easy Stripe versions 0.0 up to and including 1.1, with a fix available in version 1.1.1.
Détecte cette CVE dans ton projet
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Impact et Scénarios d'Attaquetraduction en cours…
The impact of this RCE vulnerability is severe. An attacker exploiting CVE-2025-49302 can execute arbitrary code on the server hosting the Easy Stripe payment gateway. This could lead to complete system compromise, including data exfiltration (sensitive customer payment information, database credentials), modification of system files, and installation of malware. The attacker could also leverage this access to move laterally within the network, compromising other systems and escalating privileges. Given the nature of a payment gateway, the potential for financial fraud and reputational damage is significant.
Contexte d'Exploitationtraduction en cours…
The vulnerability's public disclosure date is 2025-07-04. Exploitation probability is currently assessed as medium, given the RCE nature and the potential for easy exploitation once a suitable payload is crafted. No public Proof-of-Concept (POC) exploits have been observed at the time of writing, but the ease of code inclusion suggests that POCs are likely to emerge. This vulnerability is not currently listed on KEV or EPSS, but its critical severity warrants close monitoring.
Renseignement sur les Menaces
Statut de l'Exploit
EPSS
0.09% (percentile 25%)
CISA SSVC
Vecteur CVSS
Que signifient ces métriques?
- Attack Vector
- Réseau — exploitable à distance via internet. Aucun accès physique ou local requis.
- Attack Complexity
- Faible — aucune condition spéciale requise. Exploitable de manière fiable.
- Privileges Required
- Aucun — sans authentification. Aucune identifiant requis pour exploiter.
- User Interaction
- Aucune — attaque automatique et silencieuse. La victime ne fait rien.
- Scope
- Modifié — l'attaque peut pivoter au-delà du composant vulnérable.
- Confidentiality
- Élevé — perte totale de confidentialité. L'attaquant peut lire toutes les données.
- Integrity
- Élevé — l'attaquant peut écrire, modifier ou supprimer toutes les données.
- Availability
- Élevé — panne complète ou épuisement des ressources. Déni de service total.
Logiciel Affecté
Classification de Faiblesse (CWE)
Chronologie
- Réservé
- Publiée
- Modifiée
- EPSS mis à jour
Mitigation et Contournementstraduction en cours…
The primary mitigation for CVE-2025-49302 is to immediately upgrade Easy Stripe to version 1.1.1 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing a temporary workaround by restricting file access permissions on the server hosting Easy Stripe. Specifically, ensure that the include_path configuration is carefully reviewed and that only trusted directories are included. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to include arbitrary files. After upgrading, verify the fix by attempting to trigger the code inclusion vulnerability and confirming that it is no longer exploitable.
Comment corrigertraduction en cours…
Actualiza el plugin Easy Stripe a la versión 1.1.1 o superior para mitigar la vulnerabilidad de ejecución remota de código. Asegúrate de realizar una copia de seguridad de tu sitio web antes de actualizar cualquier plugin.
Questions fréquentestraduction en cours…
What is CVE-2025-49302 — RCE in Easy Stripe Payment Gateway?
CVE-2025-49302 is a critical Remote Code Execution (RCE) vulnerability in Easy Stripe, allowing attackers to execute arbitrary code. It affects versions 0.0 through 1.1 and can lead to full system compromise and data theft.
Am I affected by CVE-2025-49302 in Easy Stripe Payment Gateway?
If you are using Easy Stripe version 0.0 through 1.1, you are affected by this vulnerability. Immediately check your version and upgrade to 1.1.1 or later.
How do I fix CVE-2025-49302 in Easy Stripe Payment Gateway?
The recommended fix is to upgrade Easy Stripe to version 1.1.1 or later. As a temporary workaround, restrict file access permissions and implement WAF rules to prevent code inclusion.
Is CVE-2025-49302 being actively exploited?
While no public exploits have been observed, the vulnerability's severity and ease of exploitation suggest that active exploitation is possible. Continuous monitoring is recommended.
Where can I find the official Easy Stripe advisory for CVE-2025-49302?
Refer to the official Easy Stripe website and security advisories for the latest information and updates regarding CVE-2025-49302. Check their documentation and release notes.
Ton projet est-il affecté ?
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Détecte cette CVE dans ton projet
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Scannez votre projet WordPress maintenant — sans compte
scanZone.subtitle
Glissez-déposez votre fichier de dépendances
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...