WordPress security changelog
MEDIUM CVE-2026-12654 Deferred

Unsigned Stripe webhooks can mark arbitrary WooCommerce orders paid

Payment Plugins for Stripe WooCommerce through 4.0.7 accepts POST requests to /wp-json/wc-stripe/v1/webhook while the selected live or test webhook secret is blank, which is the plugin's default until a Stripe-issued secret is configured. An unauthenticated attacker can forge a charge.pending event whose metadata.order_id and metadata.gateway_id select a pending asynchronous order and payment gateway; a charge object with status=succeeded and captured=true reaches wc_stripe_process_charge_pending() and payment_complete(), marking the order paid and potentially starting fulfillment with an attacker-supplied transaction ID.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Payment Plugins for Stripe WooCommerce
Plugin slug
woo-stripe-payment
Affected
<= 4.0.7
Safe version
4.0.8
Published
Jul 24, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Jul 24, 2026 and is one of 2 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Payment Plugins for Stripe WooCommerce to 4.0.8 or later and configure Stripe-issued whsec_ webhook secrets for every enabled live and test mode. Version 4.0.8 rejects the webhook with 401 before Stripe event construction whenever the corresponding secret is empty. Review paid or fulfilled asynchronous orders for a matching legitimate Stripe charge and transaction ID.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources