CVE-2026-12654 in Payment Plugins for Stripe WooCommerce Plugin
Summary
by MITRE • 07/24/2026
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability in the Payment Plugins for Stripe WooCommerce plugin represents a critical authorization bypass flaw that undermines the core payment processing security mechanisms within WordPress e-commerce environments. This weakness affects all versions up to and including 4.0.7, creating a pathway for unauthenticated attackers to manipulate payment statuses without proper authentication credentials. The issue stems from inadequate user authorization verification within the plugin's webhook handling logic, specifically failing to validate that incoming requests originate from legitimate Stripe sources rather than malicious actors.
The technical implementation of this vulnerability exploits the plugin's reliance on webhook events to process payment confirmations, particularly targeting the charge.pending event handler. Attackers can construct forged webhook payloads containing attacker-controlled metadata including order_id and gateway_id fields, alongside a charge object with status=succeeded and captured=true parameters. This manipulation triggers the payment_complete() function within the WooCommerce framework, effectively bypassing normal payment validation procedures that would typically require proper authentication and verification. The forged events seamlessly integrate into the downstream fulfillment workflows, causing the system to process orders as if they were legitimately paid using attacker-supplied transaction identifiers.
The operational impact of this vulnerability extends beyond simple unauthorized payment processing, potentially enabling attackers to execute broader supply chain disruptions within e-commerce operations. When successful, these attacks can result in fraudulent order fulfillment, inventory discrepancies, revenue loss, and compromised customer data integrity. The vulnerability's exploitation requires only that merchants leave the webhook secret configuration fields blank, which represents the default plugin state until manual configuration occurs. This default configuration creates a dangerous security gap where systems operate without proper signature verification mechanisms, making the attack surface significantly larger than it should be.
Mitigation strategies must focus on immediate configuration remediation and operational hardening measures. The primary defense involves ensuring that merchants manually configure valid Stripe webhook secrets through the whsec_ values provided by Stripe, eliminating the default blank state that enables the bypass. Security practitioners should conduct comprehensive audits of all WooCommerce installations to identify vulnerable plugin versions and verify proper webhook secret implementation. Additionally, implementing network-level monitoring for suspicious webhook traffic patterns and establishing automated alerting for unauthorized payment status modifications can provide early detection capabilities. Organizations should also consider implementing principle of least privilege controls within their WordPress environments to limit the scope of potential damage from compromised systems.
This vulnerability aligns with CWE-863 (Authorization Bypass Through User Control) and demonstrates characteristics consistent with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing). The attack vector leverages the trust relationship between Stripe and WordPress by exploiting misconfigured security parameters, while the authorization bypass allows attackers to assume legitimate payment processing roles within the system. The default configuration state creates a persistent risk that persists across multiple installations until actively addressed by administrators, making it particularly dangerous in environments where security updates are delayed or neglected. Organizations should implement regular security assessments focused on third-party plugin configurations and maintain updated threat intelligence regarding similar vulnerabilities in e-commerce platforms to prevent exploitation of these types of authorization bypass flaws.