paymentplugins Payment Plugins for Stripe WooCommerce Plugin up to 4.0.7 on WordPress Signature Verification payment_complete order_id/gateway_id/status authorization

Summaryinfo

A vulnerability labeled as problematic has been found in paymentplugins Payment Plugins for Stripe WooCommerce Plugin up to 4.0.7. This affects the function payment_complete of the component Signature Verification. Such manipulation of the argument order_id/gateway_id/status leads to authorization. This vulnerability is listed as CVE-2026-12654. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in paymentplugins Payment Plugins for Stripe WooCommerce Plugin up to 4.0.7. It has been rated as problematic. Affected by this issue is the function payment_complete of the component Signature Verification. The manipulation of the argument order_id/gateway_id/status with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is integrity. CVE summarizes:

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.

The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-12654 since 06/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-48509). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• paymentplugins

Name

• Payment Plugins for Stripe WooCommerce Plugin

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion