PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45217 ThemeHigh CVE debrief

CVE-2026-45217 is a medium-severity authentication bypass vulnerability in the Stripe Payment Gateway for WooCommerce WordPress plugin, affecting versions up to and including 5.0.7. The vulnerability, classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), enables password recovery exploitation, allowing attackers to potentially bypass authentication controls. The issue was published in the NVD on May 25, 2026, with a subsequent modification on May 26, 2026. The CVSS 3.1 score of 6.5 reflects network attack vector with low complexity, no privileges required, and no user interaction needed, resulting in low integrity and availability impact. The vulnerability status is currently marked as 'Deferred' in the NVD. Organizations using this plugin should prioritize updating to a patched version beyond 5.0.7 and review authentication flows for the password recovery mechanism.

Vendor
ThemeHigh
Product
Stripe Payment Gateway for WooCommerce
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-05-26
Advisory published
2026-05-25
Advisory updated
2026-05-26

Who should care

Organizations operating WooCommerce e-commerce platforms using ThemeHigh's Stripe Payment Gateway plugin; WordPress site administrators; security teams monitoring payment gateway integrations; compliance officers responsible for PCI-DSS scoped systems with authentication controls

Technical summary

The Stripe Payment Gateway for WooCommerce plugin (versions ≤5.0.7) contains an authentication bypass vulnerability (CWE-288) in its password recovery mechanism. The flaw allows attackers to exploit alternate authentication paths, potentially enabling unauthorized account access without valid credentials. The vulnerability is remotely exploitable with no authentication prerequisites, making it accessible to unauthenticated network attackers. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) indicates network-based attack with low complexity, no privilege requirements, and impacts to integrity and availability.

Defensive priority

medium

Recommended defensive actions

  • Update Stripe Payment Gateway for WooCommerce plugin to version 5.0.8 or later
  • Review WordPress user account security logs for anomalous password reset activities between May 25, 2026 and patch deployment
  • Implement additional authentication monitoring for WooCommerce admin accounts
  • Consider implementing Web Application Firewall (WAF) rules to detect abnormal password recovery request patterns
  • Verify plugin update source authenticity through official WordPress.org repository or ThemeHigh direct distribution channels

Evidence notes

Vulnerability identified through Patchstack security research. NVD record shows deferred status as of May 26, 2026.

Official resources

public