Junglewise Threat Intelligence

CVE-2026-12654: Payment Plugins Stripe WooCommerce authorization bypass in webhooks

CVE-2026-12654 · Severity: medium · CVSS 5.3 · Published 2026-07-24

Vendors: Payment Plugins.

Executive brief

A vulnerability in a popular WordPress payment plugin for Stripe allows unauthorized individuals to mark pending orders as paid without actually providing payment. This could lead to financial loss for merchants as the system may automatically trigger the shipment of goods or provide access to digital services for fraudulent transactions. The issue occurs when the merchant has not yet configured a specific security secret provided by Stripe.

Technical details

The Payment Plugins for Stripe WooCommerce plugin for WordPress (versions <= 4.0.7) contains a missing authorization vulnerability (CWE-862) in its webhook handling logic. Unauthenticated attackers can forge a 'charge.pending' event with malicious metadata (order_id and gateway_id) and a status of 'succeeded'. This triggers the payment_complete() function and downstream fulfillment flows. The vulnerability is exploitable if the merchant has left the 'webhook_secret_test' or 'webhook_secret_live' options blank, which is the default state. Once a non-empty secret is configured, signature verification prevents the bypass.

Affected products

  • Payment Plugins Payment Plugins for Stripe WooCommerce up to, and including, 4.0.7

Timeline

  • 2026-07-24: disclosed: CVE published to NVD dataset

References