CVE-2026-12654
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Payment Plugins for Stripe WooCommerce plugin for WordPress up to version 4.0.7 fails to properly verify user authorization. An unauthenticated attacker can mark arbitrary pending WooCommerce orders as paid by forging a charge.pending event with attacker-controlled data, triggering payment_complete() and order fulfillment. The vulnerability is exploitable only when the webhook_secret_test or webhook_secret_live field is left blank (default).
Risk Assessment
The organization is at risk of unauthorized order fulfillment without actual payment, potentially leading to financial loss and abuse.
Recommendation
Immediately update the plugin to the latest version and configure the webhook_secret (whsec_) in Stripe settings to enable signature verification.
Other vulnerabilities in Payment Plugins for Stripe WooCommerce
See all- CVE-2026-89100Medium
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to and including 4.0.17 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 'Generic Errors' setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.
- CVE-2026-80339Medium
The Payment Plugins for Stripe WooCommerce plugin before version 4.0.12 does not validate the order key before adding order data to the JavaScript configuration output on the front end. This allows unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
Original NVD description (English source)
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS