WordPress Plugin Vulnerabilities
WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
Description
The plugin does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.
Proof of Concept
Affects Plugins
Fixed in 1.2.2.62 References
CVE
Classification
Type
AUTHBYPASS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-23 (about 3 days ago)
Added
2026-10-23 (about 2 days ago)
Last Updated
2026-10-23 (about 2 days ago)
