Security Alert Summary
The PeachPay PeachPay – Payments & Express Checkout for WooCommerce plugin is vulnerable to a Cross-Site Request Forgery (CSRF) in affected versions up to and including 1.120.46. Missing or incorrect nonce validation in an admin handler can allow an attacker to cause an administrator to trigger a request that permanently deletes stored Stripe credentials, disabling Stripe payment processing for the store.
CVE Details
- CVE ID: CVE-2026-9618
- Affected component: PeachPay
- Affected versions: All versions up to and including 1.120.46
- Published: May 28, 2026 at 08:16:37 AM
- Last modified: May 28, 2026 at 01:45:25 PM
- CVSS v3.1 base score: 4.3 – MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: No privileges required (NONE); attacker requires user interaction (UI:R) to trick an administrator into performing an action.
- Primary impact: Integrity – LOW (deletion of Stripe credentials). Confidentiality and Availability impacts are NONE per the CVSS data.
- Weakness: CWE-352 (Cross-Site Request Forgery)
Technical Details
The vulnerability is a Cross-Site Request Forgery (CSRF) caused by missing or incorrect nonce validation in the plugins admin handling code. The CVE description identifies a specific admin handler function, peachpay_stripe_handle_admin_actions, which lacks proper nonce checks. Because the handler can be triggered via an HTTP request that an administrator might execute (for example by clicking a crafted link), an attacker can cause that handler to run with the administrators privileges.
When exploited, the handler can permanently delete stored Stripe credentials from the WordPress database, including publishable keys, secret keys, webhook secrets, and Apple Pay configuration. The immediate technical impact is removal of Stripe configuration items, which prevents the store from processing Stripe payments until credentials are restored.
How This Could Impact Your Website
Consider a small store where the site owner maintains admin access, an internal staff member manages orders, and an external contractor occasionally updates settings. If an attacker crafts a URL or page that triggers the vulnerable admin handler and convinces an administrator to click it, the site can lose its Stripe credentials. Practical consequences include:
- Immediate inability to process payments via Stripe for the affected store, potentially interrupting sales.
- Operational overhead to restore payment configuration and verify webhooks and Apple Pay settings.
- Potential customer confusion and increased support contacts if checkout fails; attackers could attempt social engineering around the disruption to impersonate the store, increasing phishing risk.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles; limit administrator access to trusted personnel only.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and admin actions for unusual behavior, such as unexpected changes to payment settings.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
References
- https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.23/core/admin/settings.php#L190
- https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.23/core/payments/stripe/functions.php#L612
- https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.23/core/payments/stripe/functions.php#L640
- https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.45/core/admin/settings.php#L190
- https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.45/core/payments/stripe/functions.php#L612
- https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.120.45/core/payments/stripe/functions.php#L640
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3550723%40peachpay-for-woocommerce&new=3550723%40peachpay-for-woocommerce&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2270b66f-b07c-44ce-b161-7b2123f8c21e?source=cve
