PatchSiren cyber security CVE debrief

CVE-2026-9618 peachpay CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability in the PeachPay for WooCommerce WordPress plugin allows unauthenticated attackers to permanently delete all stored Stripe payment credentials—including publishable keys, secret keys, webhook secrets, and Apple Pay configuration—by tricking an administrator into clicking a malicious link. The vulnerability exists due to missing or incorrect nonce validation on the `peachpay_stripe_handle_admin_actions` function. Affected versions are up to and including 1.120.46. The CVSS 3.1 score is 4.3 (Medium). The vulnerability was disclosed on 2026-05-28. No known exploitation in ransomware campaigns has been reported.

Vendor: peachpay
Product: PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
CVSS: MEDIUM 4.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-28
Advisory published: 2026-05-28
Advisory updated: 2026-05-28

Who should care

WordPress site administrators using PeachPay for WooCommerce with Stripe integration; e-commerce security teams; payment processing compliance officers

Technical summary

The PeachPay for WooCommerce plugin fails to properly validate nonces in the peachpay_stripe_handle_admin_actions function, allowing unauthenticated attackers to forge requests that delete Stripe API credentials. The attack requires social engineering an administrator into clicking a malicious link. Successful exploitation disables Stripe payment processing for the affected store by removing publishable keys, secret keys, webhook secrets, and Apple Pay configuration from the WordPress database.

Defensive priority

medium

Recommended defensive actions

Update the PeachPay for WooCommerce plugin to a version newer than 1.120.46
Verify that all Stripe payment credentials are intact and reconfigure if necessary
Review administrator access logs for suspicious activity around 2026-05-28 and subsequent days
Implement additional CSRF protections for administrative functions in custom WordPress plugins
Consider implementing Content Security Policy (CSP) headers to mitigate clickjacking risks
Train administrators to recognize and avoid suspicious links in emails or messages

Evidence notes

The vulnerability is attributed to missing or incorrect nonce validation on the peachpay_stripe_handle_admin_actions function. Source references include WordPress plugin repository browser links for versions 1.120.23 and 1.120.45, showing the affected code locations in core/admin/settings.php and core/payments/stripe/functions.php. A changeset reference indicates a patch may be available. The weakness is classified as CWE-352 (Cross-Site Request Forgery).

Sources and references

Verified primary and authoritative sources

CVE-2026-9618 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-9618

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-9618 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9618

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.23/core/admin/settings.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.23/core/payments/stripe/functions.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.23/core/payments/stripe/functions.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.45/core/admin/settings.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.45/core/payments/stripe/functions.php

[email protected]
Source reference
Unverified legacy reference

URL: https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.45/core/payments/stripe/functions.php

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.