WooCommerce security: the specific risks of online stores on WordPress
By Kike Gandia · Co-Founder & CEO, OSCP
WooCommerce turns WordPress into an e-commerce platform with access to card data, order history, customer personal data and integrated payment gateways. This layer adds security obligations (PCI-DSS for card payments) and attack vectors that go well beyond the usual risks of a corporate WordPress site.
WooCommerce-specific attack vectors
Card skimming (Magecart): Injection of malicious JavaScript into the checkout process to capture card data in real time. It can happen through a vulnerable plugin, a compromised CDN or a misconfigured third-party integration.
Price and discount manipulation: Broken business logic in coupon handling, dynamic pricing or cart calculations that allows the final amount to be modified before payment.
Order data exposure: WooCommerce REST API endpoints with incorrect permissions that expose order history, customer data or payment information to unauthorised users.
Vulnerable payment plugins: Third-party payment gateways (Redsys, Stripe, custom PayPal) are critical code that is rarely audited with the rigour it deserves.
PCI-DSS and WooCommerce: what it means for your business
If your WooCommerce store processes card data directly (rather than only redirecting to an external gateway), you are within PCI-DSS scope. This entails security requirements for the network, the system, the software and the processes. A WooCommerce pentest geared towards PCI-DSS validates the applicable technical controls and produces evidence for the compliance process.
Even if you use a gateway that tokenises card data (the most common scenario), the environment remains relevant to PCI-DSS: an attacker who compromises the server can intercept data before it reaches the gateway.
What a WooCommerce security audit covers
- Review of the checkout process: price integrity, server-side validation and protection against parameter tampering
- Analysis of the installed payment gateway plugins and their versions
- Authorisation testing on the WooCommerce REST API: access to orders, customers and payment data
- Detection of third-party scripts with access to the checkout DOM (Magecart risk)
- Review of customer account management: password reset, user enumeration and brute force
- Analysis of external integrations: CRM, ERP, marketing tools and logistics platforms
FAQ
If we use Stripe or PayPal, do we still need to audit checkout security?
Yes. The payment gateway tokenises card data, but the checkout environment is still an attack vector. A malicious script injected into the page can capture card data before it reaches Stripe. The audit covers the whole environment, not just the gateway.
Does a WooCommerce audit count as evidence for PCI-DSS?
The pentest report is valid as evidence of the security testing required by PCI-DSS. The specific scope is tailored to the requirements of the applicable merchant level.