CVE-2023-44999 is a medium severity cross-site request forgery flaw in the WooCommerce Stripe Payment Gateway plugin for WordPress, scored 5.4. The record says versions through 7.6.0 are affected. It does not name a fixed version, so update the plugin to the newest release and check the vendor changelog.
What's affected
The NVD record says the issue affects WooCommerce Stripe Payment Gateway from n/a through 7.6.0. In plain terms, every release up to and including 7.6.0 is listed, and no lower bound is given. The record was published on 2024-03-27.
NVD scores it 5.4 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, which means a network attack that needs a user to take an action, with low impact on integrity and availability.
The reference is a Patchstack database entry. The page returned an access error when I fetched it, so I could not confirm the first fixed release from the source. Treat the fixed version as unconfirmed and read the plugin changelog on WordPress.org for the release that mentions this issue.
The plugin slug used in the Patchstack address is woocommerce-gateway-stripe, which is the name you will see in WP-CLI and the plugin folder.
Weakness class: CWE-352 (cross-site request forgery).
How to check if you're exposed
List the installed version with WP-CLI from the WordPress root:
wp plugin list --name=woocommerce-gateway-stripe --fields=name,status,version,update
If WP-CLI is not available, open the WordPress admin, go to Plugins, and read the version under the plugin name. Anything at 7.6.0 or lower is in the affected range. The update column tells you whether a newer release is waiting.
What to do now
- Find every WordPress site that runs the WooCommerce Stripe Payment Gateway plugin, including staging copies.
- Update the plugin to the latest release with
wp plugin update woocommerce-gateway-stripeor from the admin Plugins page. - Read the plugin changelog to confirm the version you reach is newer than 7.6.0 and note the entry for this issue.
- Ask store administrators to sign out of the admin when not in use and to avoid following links from unknown sources while signed in.
- Turn on automatic updates for payment plugins so the next fix arrives without a ticket.
Why it matters
Cross-site request forgery, tracked as CWE-352, tricks a signed-in user's browser into sending a request the user did not intend. The site cannot tell the forged request from a real one unless it checks a secret token tied to the session. The score of 5.4 reflects that the attacker needs a user to visit a page, and that the effect is limited.
Payment plugins deserve attention even at a medium score, because settings changes touch money flow. I did not find the exact action affected in the sources I could read, so I will not guess. CVE-2023-44999 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Plugins are dependencies too. The demo below shows how continuous monitoring flags a component when a new advisory lands against a version you already run.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2023-44999?
I could not confirm it. The record says versions through 7.6.0 are affected, so install the newest release and check the changelog.
Does the attacker need to be logged in?
The vector says no privileges are required, but a user must interact, for example by following a link while signed in.
Sources
Last reviewed: 19 October 2026.
