Executive brief
The Stripe Payment Gateway for WooCommerce plugin fails to verify webhook signatures on fresh installations, allowing attackers to forge payment notifications. An attacker can send fake webhook events to mark unpaid orders as paid, cancel legitimate transactions, or inject fraudulent refund notifications, directly impacting revenue and customer transactions. This only affects sites that have not manually configured the webhook signing secret in their plugin settings.
Technical details
The plugin's webhook handler wraps the Stripe signature verification call inside a guard that checks for a configured webhook secret; on default installations this secret is empty, causing the guard to never execute and allowing unsigned webhook payloads to be processed as trusted events. An unauthenticated remote attacker can POST forged Stripe webhook events to the publicly accessible `woocommerce_api_wt_stripe` endpoint to manipulate order statuses via the `payment_complete()` method. The vulnerability is negated once an administrator configures a valid webhook signing secret, which then enforces signature verification.
Affected products
- WebToffee Stripe Payment Gateway for WooCommerce up to and including 5.0.8
Timeline
- 2026-09-19: disclosed