CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 fails to validate the order key before embedding order data in the front-end JavaScript configuration (via the order-pay endpoint). This allows unauthenticated users to enumerate sequential order identifiers and retrieve bi...

Configuring JavaScript Settings

Once you click the Advanced button, a second window opens to allow you to disable specific JavaScript features. We recommend disabling all of the options displayed in this dialog...