An attacker who can trick a site administrator into clicking a forged link can trigger a Cross‑Site Request Forgery in the PeachPay plugin. The vulnerable peachpay_stripe_handle_admin_actions function lacks proper nonce validation, allowing the attacker to permanently remove all stored Stripe credentials from the WordPress database. This deletion disables Stripe payment processing, including publishable keys, secret keys, webhook secrets, and Apple Pay configuration, effectively blocking the store’s ability to accept payments through Stripe.

The vulnerability affects the PeachPay plugin for WooCommerce version 1.120.46 and all older releases. This plugin, provided by the partner PeachPay, enables payment processing for Stripe among other gateways. The issue is specific to the Stripe integration path within the plugin.

The CVSS score of 4.3 indicates moderate severity. Because the exploit relies on CSRF and requires an attacker to entice a logged‑in administrator to perform an action, the overall likelihood of exploitation is lower than for a remote code execution flaw, and the EPSS value is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker could achieve denial of payment services by deleting credentials, but would need the victim to act on the malicious link.