Split Pay for Stripe on WooCommerce <= 3.8.4 - Authenticated (Vendor+) Missing Authorization to Dokan Supplier Vendor Payout Modification
- ID
- WPSEC-2026-0415
- Plugin
- Split Pay – Stripe Connect Split Payments & Multi-Vendor Marketplace for WooCommerce & FluentCart (bsd-woo-stripe-connect-split-pay)
- Affected
- from 3.8.0 before 3.8.5
- Remediation
- Update to 3.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Split Pay for Stripe on WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Split Pay plugin for WordPress is vulnerable to unauthorized modification of data in versions 3.8.0 up to, and including, 3.8.4 due to a missing capability check in the Dokan Supplier Vendor field save routine, which relied only on the product-edit permission already verified by WooCommerce or Dokan. This makes it possible for authenticated attackers with Dokan vendor access to set or clear the Supplier Vendor and its payment on their own products, directing an additional Stripe transfer from each sale to another vendor's connected account or removing a supplier payout configured by the store. Exploitation requires the PRO Dokan integration with the Supplier Vendor feature to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0415/
- https://plugins.svn.wordpress.org/bsd-woo-stripe-connect-split-pay/tags/3.8.5/
- https://wordpress.org/plugins/bsd-woo-stripe-connect-split-pay/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS