Automated card-testing attacks can abuse legitimate WooCommerce payment features without exposing existing customer card data. In one incident, attackers created large numbers of fake customer accounts and used the standalone Add Payment Method flow to submit stolen card numbers for verification through Braintree.
The immediate fix was to remove that standalone saved-card path entirely. The Add Payment Method form was disabled, the related button was removed from the Payment Methods screen, and the Payment Methods link was removed from My Account. Normal checkout remained unchanged, including guest checkout and entering a new card during an order.
Issue background
The issue first surfaced when people reported receiving WordPress account-creation emails for accounts they had never created.
Audit logs for those accounts also showed a custom field named wc_braintree_token_check, which raised concern that payment information might have been exposed.
Further review found that the suspicious accounts used randomized names, addresses, and other profile data. Traffic came from rotating IP addresses across multiple countries, which was consistent with scripted activity rather than legitimate customer registrations.
Over roughly 60 days, the investigation identified approximately 4,400 accounts matching the same pattern: a Braintree Vault customer ID, no orders, and randomized account information.
Diagnosis
The wc_braintree_token_check field was not evidence that customer card data had been exposed.
That field is written by the Payment Plugins Braintree gateway and stores a Unix timestamp indicating when the gateway should next re-sync a user’s stored payment methods from the Braintree Vault. It does not contain a card number, payment token, or personally identifiable information.
In the suspicious accounts, a Braintree Vault customer ID had been created, but no payment method had been successfully stored. That matched the expected state after a failed card verification.
The actual attack path was the standalone WooCommerce Add Payment Method page inside My Account. A bot would:
- Create a WordPress customer account using a real person’s email address and randomized profile information.
- Log into that account.
- Open the standalone Add Payment Method page.
- Submit a card number.
- Use Braintree’s verification result to determine whether the stolen card number was valid.
WooCommerce attribution data confirmed that the standalone Add Payment Method page was the entry point being abused. This flow was separate from normal checkout, which is why legitimate orders were not affected.
Resolution steps
The completed fix focused on removing the verification path the attackers were exploiting.
- Confirm the payment metadata was not sensitive. The team verified that
wc_braintree_token_checkwas only a synchronization timestamp and did not expose card data or stored payment tokens. - Identify the attack pattern. Fraudulent accounts were correlated by randomized account data, rotating IP addresses, Braintree Vault customer IDs, and a lack of completed orders.
- Trace the entry point. WooCommerce attribution data showed that the abusive traffic was using the standalone Add Payment Method flow rather than checkout.
- Verify that saved cards were not required by the business. The site did not depend on subscriptions or recurring billing, so removing the standalone saved-card feature would not disrupt an essential workflow.
- Disable the Add Payment Method form with code. The gateway’s Saved Cards setting alone did not remove the standalone page, so a small code change was used instead.
- Replace the form with a message. The Add Payment Method page was changed so it no longer displayed the card-entry form and instead indicated that no payment methods were available to add.
- Remove the Add Payment Method button. The action was removed from the Payment Methods screen so users could no longer reach the disabled flow through the normal interface.
- Remove Payment Methods from My Account navigation. The related My Account menu link was also removed.
- Verify checkout remains unchanged. Guest checkout, entering a fresh card during checkout, and staff placing orders on behalf of customers were all intended to continue working as before.
- Test on staging before production. The revised account and payment-method behavior was reviewed on staging, approved, and then pushed live.
The broader response also discussed future fraudulent-account cleanup, stronger registration filtering, monitoring, and Braintree-side protections such as Advanced Fraud Management and requiring CVV. However, those items were not documented as completed in this task and should be treated as follow-up measures rather than part of the confirmed production fix.
Final outcome
The standalone WooCommerce Add Payment Method path was removed from production, closing the specific verification flow the automated card-testing campaign had been exploiting.
Normal one-time card payments at checkout were intentionally left intact. The completed change therefore reduced the attack surface without disrupting the site’s standard purchase flow.
The key lesson is that card-testing abuse does not always mean stored customer card data has been compromised. In this case, attackers were supplying their own stolen card numbers and using a legitimate payment-verification feature as an oracle. Identifying and removing that unnecessary standalone verification path was the most targeted immediate fix.
If your WooCommerce site is seeing suspicious account creation, Braintree verification abuse, card-testing attempts, or unexpected saved-payment activity, contact Freshy. Our WordPress team can help trace the attack path and harden the affected account and payment workflows.
