Is CVE-2026-9832 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9832 being exploited in the wild.

How severe is CVE-2026-9832?

Medium severity, with a CVSS score of 5.3, published 19 September 2026.

Which products and versions are affected?

WebToffee Stripe Payment Gateway for WooCommerce up to and including 5.0.8.

Is there a fix for CVE-2026-9832?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9832 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9832?

Check whether you run WebToffee Stripe Payment Gateway for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9832: Stripe Payment Gateway for WooCommerce improper cryptographic signature verification

CVE-2026-9832 · Severity: medium · CVSS 5.3 · Published 2026-09-19

The Stripe Payment Gateway for WooCommerce plugin fails to verify webhook signatures on fresh installations, allowing attackers to forge payment notifications. An attacker can send fake webhook events to mark unpaid orders as paid, cancel legitimate transactions, or inject fraudulent refund notifications, directly impacting revenue and customer transactions. This only affects sites that have not manually configured the webhook signing secret in their plugin settings.

Vendors: WebToffee.

Quick answers

Is CVE-2026-9832 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9832 being exploited in the wild.
How severe is CVE-2026-9832?: Medium severity, with a CVSS score of 5.3, published 19 September 2026.
Which products and versions are affected?: WebToffee Stripe Payment Gateway for WooCommerce up to and including 5.0.8.
Is there a fix for CVE-2026-9832?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9832 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9832?: Check whether you run WebToffee Stripe Payment Gateway for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin's webhook handler wraps the Stripe signature verification call inside a guard that checks for a configured webhook secret; on default installations this secret is empty, causing the guard to never execute and allowing unsigned webhook payloads to be processed as trusted events. An unauthenticated remote attacker can POST forged Stripe webhook events to the publicly accessible `woocommerce_api_wt_stripe` endpoint to manipulate order statuses via the `payment_complete()` method. The vulnerability is negated once an administrator configures a valid webhook signing secret, which then enforces signature verification.

Affected products

WebToffee Stripe Payment Gateway for WooCommerce up to and including 5.0.8

Timeline

2026-09-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.