PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)

PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 5.5, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 6 issues recorded for PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, one record each. PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

6

Get automatic notifications for all PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2025-9463

Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter

Read the full analysis

Vulnerability Records

6 records
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) banner
Latestv1.121.0

PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)

peachpay

Author

peachpay

4.2(33)
84/100
Last Updated
2026-10-26 (2d ago)
Active Installs
300+
Downloads
176,162
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2020-08-12 (6y ago)

Forget multiple plugins — manage your checkout and payments from one place. Connect payment methods from ConvesioPay, Stripe, PayPal, Square, Authorize.net, and NMI. Give your shoppers a beautiful, simple Express Checkout, sell in different currencies using the Currency Switcher, customize your checkout with the Field Editor, and automatically show Recommend Products to increase average order value. It’s everything you need, together. Payments Connect and manage your payments in one place. Link or create a ConvesioPay, Stripe, Square, PayPal, Authorize.net, or NMI account in seconds Accept purchase orders with PeachPay’s custom purchase order payment method For ConvesioPay payments Accept credit/debit cards, Apple Pay, Google Pay, and Bitcoin (BTCPay) Accelerated Checkout with Apple Pay and Google Pay on the WooCommerce checkout page Works with WooCommerce Subscriptions All payment methods Rename payment methods Add custom fees per payment method (fixed amount or percent, custom label, and set a minimum or maximum for when the fee should apply) Configure minimum and maximum amounts for when payment methods should show (to avoid credit card fees on expensive items, for example) Turn on test mode to try out payment methods before going live 3D Secure and Strong Customer Authentication (SCA) Restrict payment methods to certain countries and currencies Set a default currency to still show the payment method in case the customer chooses an unsupported currency Option to automatically refund (or void if not yet captured) cancelled orders (except Square) For Stripe payments Accept payments through credit/debit cards, Apple Pay and Google Pay, Affirm, Klarna, Afterpay/Clearpay, US bank account ACH, Bancontact, iDEAL, Przelewy24, EPS, and SEPA Direct Debit Choose between Capture and Authorize charge types Automatically change order status when a customer disputes a payment Reset the order status when the dispute is closed Set a custom statement descriptor For card payments, set a custom statement descriptor suffix Force 3D Secure Works with WooCommerce Subscriptions (card, Apple and Google Pay, ACH, SEPA) For PayPal payments Accept payments through PayPal, PayPal Pay later, PayPal Credit, and Venmo Customize button color, shape, label, and height without code Set a store name to be shown in the PayPal window Show line items in the PayPal window For Square payments Accept payments through credit/debit cards, Apple Pay and Google Pay, US bank account ACH, Afterpay, and Cash App Works with WooCommerce Subscriptions (card payments only) For Authorize.net payments Accept credit/debit cards Choose between Capture and Authorize charge types Automatically capture authorized payments when the order status is changed to complete Show itemized order information in the Authorize.net dashboard For NMI payments Accept credit/debit cards Choose between Capture and Authorize charge types Automatically capture authorized payments when the order status is changed to complete Direct payment processing without additional redirect steps Order export Export orders to CSV from the WooCommerce orders screen under “Bulk actions” Bot Protection Prevent fraudulent and spam checkouts on your store. Powered by Google reCAPTCHA v3 (API keys required, but easy to get and free—we guide you through it) Doesn’t add any puzzles to your checkout Blocks bots behind the scenes with ML and AI technology Protects your reputation with payment providers Blocks fake and stolen credit card attacks Works on the WooCommerce checkout page and in Express Checkout Express Checkout Want to let shoppers buy from product pages? Not satisfied with how your WooCommerce checkout page looks? Want to keep a consistent checkout while changing your store’s theme? PeachPay’s Express Checkout has you covered. Add an Express Checkout button to all product pages, cart page, mini/sidebar cart, and checkout page Shortcodes and Elementor widget for placing the Express Checkout button on home page, shop page, or anywhere else on your store Set your button text, color, width, icon, hover effect, alignment, border radius, and visibility by page Display payment method icons below the button Automatically match your theme’s font style Upload your store’s logo to show in the checkout window Modify the checkout fields with our Field Editor Accept coupon and discount codes Show or hide order notes, product images, and quantity changer Automatically display the most appropriate language (25+ supported) in the Express Checkout window based on customer’s preferences Automatically hide shipping fields for virtual products Show a custom support message to your shoppers Built-in upsell funnel builder & configurable related products gallery Automatically display upsells & cross-sells configured through WooCommerce product settings Test mode allows you to try Express Checkout on your live site before customers see it (before connecting your payment accounts) Fully compatible with WooCommerce subscriptions and its most popular add-ons Address autocomplete for billing and shipping fields Add custom CSS and JavaScript Currency Switcher Support 131 currencies in one click. No API keys or account required Exchange rates are loaded from ExchangeRate-API If a currency is not supported by a payment method, we’ll let you know Show currencies based on either geolocation or billing country You can pass on currency conversion fees to shoppers Automatic exchange rates, but you can also modify them if you want Add your own custom fees per currency Customize how many decimal shows and how to round the numbers Restrict currencies to certain countries Place a widget anywhere on your store to let users switch between multiple currencies Address Autocomplete Suggest addresses to shoppers as they begin typing their address. No merchant API key or account required Address suggestions are requested from Radar Works on both the checkout page and in our Express Checkout Can be configured to appear in one of the locations or both Can be turned off Works even if your checkout doesn’t have some address fields Supports international addresses Significantly reduces the time it takes for a shopper to fill out the checkout Field Editor Add, edit, and remove any field on the checkout page or in PeachPay’s express checkout window. Adjust billing and shipping fields independently Add custom additional fields No coding skills required You can change the field name (for compatibility with other plugins), label, and type (text, checkbox, etc.) Adjust the width of each field Make fields either required or optional Disable fields that you’re not using temporarily Field types include text, select (drop down), radio (choose one option), phone, email, checkbox Add headers to create new sections We automatically pull in fields from other popular field editors for an easy transition Product Recommendations Display random WooCommerce related products on every single product page load (in a slider or not) based on the current product’s category, tags, or attributes. Benefits By making the checkout and payment experience frictionless and stable, PeachPay increases sales, customer loyalty, and average order value. Whether you plan to use PeachPay as a supplementary checkout option or as the only way to pay on your store, you can expect to benefit from PeachPay in no time. PeachPay is fully capable of powering your entire checkout and payment process. Cost PeachPay is free to use. There is no PeachPay subscription and no PeachPay service fee on orders. You keep your existing rates with the payment processors. Questions? Reach out at support@convesio.com. External services PeachPay sends data to a service only when you use the feature that needs it. ConvesioPay (api.convesiopay.com, or api-qa.convesiopay.com in test mode, plus js.convesiopay.com and checkout.convesiopay.com) receives order and payment details when a shopper pays with ConvesioPay, including card, Apple Pay, Google Pay, and BTCPay. The Apple Pay setup screen links to a domain certificate on dev.convesiopay.com. Terms, privacy. Stripe (api.stripe.com and js.stripe.com) receives order and payment details when Stripe is connected. Stripe.js also handles Apple Pay and Google Pay for Stripe. Terms, privacy. PayPal (api.paypal.com, or api.sandbox.paypal.com in test mode, and www.paypal.com for the PayPal checkout script) receives order and payment details when PayPal is connected. Terms, privacy. Square (connect.squareup.com, or connect.squareupsandbox.com in test mode, and web.squarecdn.com or sandbox.web.squarecdn.com for Square.js) receives order and payment details when Square is connected. Square.js also handles Apple Pay and Google Pay for Square. Terms, privacy. Authorize.net (api.authorize.net, or apitest.authorize.net in test mode, and js.authorize.net or jstest.authorize.net for Accept.js) receives order and payment details when Authorize.net is connected. Terms, privacy. NMI (convesio.transactiongateway.com by default, or the gateway domain you configure, including Collect.js at /token/Collect.js) receives card payment details when NMI is enabled. Terms, privacy. Klaviyo (a.klaviyo.com) receives the shopper’s email, phone, and country when Klaviyo’s WooCommerce plugin is active and the shopper checks the SMS or newsletter consent box. The request uses the store’s Klaviyo public key. Terms, privacy. Google reCAPTCHA v3 (www.google.com/recaptcha) receives a checkout token when Bot Protection is enabled. The browser loads the reCAPTCHA script, and the store verifies the token with Google. You provide the site and secret keys. Terms, privacy. Radar (api.radar.io) receives the address a shopper starts typing when Address Autocomplete is on. Terms, privacy. ExchangeRate-API (api.exchangerate-api.com) receives the store base currency when Currency Switcher refreshes rates. Its terms page includes the privacy policy. Terms and privacy. Google Fonts (fonts.googleapis.com and fonts.gstatic.com) receives the admin’s IP address when the ConvesioPay connect screen loads the Inter font. Terms, privacy. CKEditor (cdn.ckeditor.com) loads its editor script when you edit a scrollable-text checkout field. Terms, privacy. cdnjs (cdnjs.cloudflare.com) loads Select2 on the product recommendation settings screen. It is served by Cloudflare. Terms, privacy. Iconfinder (cdn3.iconfinder.com) loads an icon on the plugin deactivation dialog. Terms, privacy. Sentry (browser.sentry-cdn.com) loads a browser script on Express Checkout. Error reporting is turned off, so checkout details are not sent to Sentry. Terms, privacy.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C