PatchSiren cyber security CVE debrief
CVE-2026-9618 peachpay CVE debrief
A Cross-Site Request Forgery (CSRF) vulnerability in the PeachPay for WooCommerce WordPress plugin allows unauthenticated attackers to permanently delete all stored Stripe payment credentials—including publishable keys, secret keys, webhook secrets, and Apple Pay configuration—by tricking an administrator into clicking a malicious link. The vulnerability exists due to missing or incorrect nonce validation on the `peachpay_stripe_handle_admin_actions` function. Affected versions are up to and including 1.120.46. The CVSS 3.1 score is 4.3 (Medium). The vulnerability was disclosed on 2026-05-28. No known exploitation in ransomware campaigns has been reported.
- Vendor
- peachpay
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-28
Who should care
WordPress site administrators using PeachPay for WooCommerce with Stripe integration; e-commerce security teams; payment processing compliance officers
Technical summary
The PeachPay for WooCommerce plugin fails to properly validate nonces in the peachpay_stripe_handle_admin_actions function, allowing unauthenticated attackers to forge requests that delete Stripe API credentials. The attack requires social engineering an administrator into clicking a malicious link. Successful exploitation disables Stripe payment processing for the affected store by removing publishable keys, secret keys, webhook secrets, and Apple Pay configuration from the WordPress database.
Defensive priority
medium
Recommended defensive actions
- Update the PeachPay for WooCommerce plugin to a version newer than 1.120.46
- Verify that all Stripe payment credentials are intact and reconfigure if necessary
- Review administrator access logs for suspicious activity around 2026-05-28 and subsequent days
- Implement additional CSRF protections for administrative functions in custom WordPress plugins
- Consider implementing Content Security Policy (CSP) headers to mitigate clickjacking risks
- Train administrators to recognize and avoid suspicious links in emails or messages
Evidence notes
The vulnerability is attributed to missing or incorrect nonce validation on the peachpay_stripe_handle_admin_actions function. Source references include WordPress plugin repository browser links for versions 1.120.23 and 1.120.45, showing the affected code locations in core/admin/settings.php and core/payments/stripe/functions.php. A changeset reference indicates a patch may be available. The weakness is classified as CWE-352 (Cross-Site Request Forgery).
Official resources
2026-05-28