WP Stripe Checkout: Missing webhook secret allows forged completed orders
WP Stripe Checkout skips Stripe webhook-signature verification when no signing secret is configured, which is its default state. In that configuration, an unauthenticated attacker can forge a payment-completion notification and create a completed order without paying. The webhook endpoint and payload field names are not disclosed in the export; the described bypass is conditional on the absent secret. Published affected versions: < 1.2.2.62.
- Component
- WP Stripe Checkout
- Plugin slug
wp-stripe-checkout- Affected
- < 1.2.2.62
- Safe version
1.2.2.62- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
Update WP Stripe Checkout to 1.2.2.62 or later. Require a configured signing secret and reject notifications that cannot be authenticated; do not accept a missing secret as a reason to skip verification. Reconcile payment status, amount and order identity with Stripe before fulfilment, and review completed orders against provider records.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.