wc-api Vulnerabilities

Scammers are targeting one of my sites WooCoomerce sites wc-api via Stripe. I’m getting thousands of requests via ?wc-api=wc_stripe. They’re checking credit cards which are being logged in stripe. I have put the site into maintenance mode but they’re still able to check cards and create logs/responses in stripe. I’m at a loss as to how I can protect the wc-api=wc_stripe endpoints from this abuse, putting the site into maintenance and activating Cloudflares “I’m under attack” security doesn’t slow it down. Any direction/help would be appreciated.