CVE-2026-110285: WP Stripe Checkout · Improper Authentication
Affects WP Stripe CheckoutSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 08:15:02 UTC
Rated High by the CNA (WPScan) · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WP Stripe Checkout | Affected
| Fixed in
|
AI-suggested
Upgrade WP Stripe Checkout to version 1.2.2.62 or later where this issue is fixed. If upgrading is not immediately possible, configure a Stripe webhook signing secret to ensure webhook signature verification is enforced. Patch status is not explicitly confirmed in the input, but the version 1.2.2.62 indicates a fix is available.
Description
WP Stripe Checkout versions before 1.2.2.62 do not verify Stripe webhook signatures when no signing secret is configured, which is the default setting. This improper authentication allows unauthenticated attackers to forge payment completion notifications and create completed orders without actual payment.
Impact
An attacker can bypass payment verification by forging webhook notifications, potentially leading to unauthorized creation of completed orders without payment. This can cause financial loss and order fulfillment issues for merchants using the affected plugin versions.
Summary
The WP Stripe Checkout WordPress plugin prior to version 1.2.2.62 fails to verify the Stripe webhook signature if no signing secret is configured, which is the default configuration. This vulnerability (CWE-287) allows an attacker to send forged webhook notifications that the plugin accepts as valid, resulting in the creation of completed orders without payment confirmation.
Weaknesses
- CWE-287Improper Authentication (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.