CVE-2026-9618

Name of the Vulnerable Software and Affected Versions PeachPay — Payments & Express Checkout for WooCommerce versions prior to 1.120.47

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the peachpay stripe handle admin actions() function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to permanently delete stored Stripe credentials from the WordPress database, including secret keys, publishable keys, webhook secrets, and Apple Pay configuration, by tricking a site administrator into clicking a malicious link. This action effectively disables Stripe payment processing for the store.

Recommendations Update PeachPay — Payments & Express Checkout for WooCommerce to version 1.120.47 or later.