The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
Configurations
History
21 Mar 2025, 17:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wpplugin
Wpplugin paypal \& Stripe Add-on |
|
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040958%40contact-form-7-paypal-add-on&new=3040958%40contact-form-7-paypal-add-on&sfp_email=&sfph_mail= - Patch | |
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040962%40wp-ecommerce-paypal&new=3040962%40wp-ecommerce-paypal&sfp_email=&sfph_mail= - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/a5276227-9bd4-4ad8-a6b7-ac7d05e8b056?source=cve - Third Party Advisory | |
| CWE | CWE-352 | |
| CPE | cpe:2.3:a:wpplugin:paypal_\&_stripe_add-on:*:*:*:*:*:wordpress:*:* |
Information
Published : 2024-02-28 10:15
Updated : 2025-03-21 17:48
NVD link : CVE-2024-1719
Mitre link : CVE-2024-1719
CVE.ORG link : CVE-2024-1719
JSON object : View
Products Affected
wpplugin
- paypal_\&_stripe_add-on
CWE
CWE-352
Cross-Site Request Forgery (CSRF)