PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)

Information

Software Type Plugin
Software Slug peachpay-for-woocommerce (view on wordpress.org)
Software Status Active
Software Author peachpay
Software Website woocommerce.com
Software Downloads 170,052
Software Active Installs 300
Software Record Last Updated July 21, 2026

5 Vulnerabilities

Submit a Vulnerability
PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink
4.3
CVE-2026-9618
May 27, 2026
Researcher: Benedictus Jovan (aillesiM)
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification
5.3
CVE-2025-14978
Jan 19, 2026
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter
6.5
CVE-2025-9463
Sep 9, 2025
Researcher: Peter Thaleikis
PeachPay Payments <= 1.117.4 - Missing Authorization
5.3
CVE-2025-58634
Sep 3, 2025
Researcher: Nabil Irawan
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.112.0 - Reflected Cross-Site Scripting
6.1
CVE-2024-11362
Nov 22, 2024
Researcher: vgo0
Title Status CVE ID CVSS Researchers Date
PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink Patched CVE-2026-9618 4.3 Benedictus Jovan (aillesiM) May 27, 2026
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification Patched CVE-2025-14978 5.3 Md. Moniruzzaman Prodhan (NomanProdhan) January 19, 2026
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter Patched CVE-2025-9463 6.5 Peter Thaleikis September 9, 2025
PeachPay Payments <= 1.117.4 - Missing Authorization Patched CVE-2025-58634 5.3 Nabil Irawan September 3, 2025
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.112.0 - Reflected Cross-Site Scripting Patched CVE-2024-11362 6.1 vgo0 November 22, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation