CVE-2026-12654: CWE-862 Missing Authorization in paymentplugins Payment Plugins for Stripe WooCommerce
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
AI Analysis
Technical Summary
CVE-2026-12654 is an authorization bypass vulnerability (CWE-862) in the Payment Plugins for Stripe WooCommerce WordPress plugin. The plugin fails to properly verify user authorization when processing asynchronous payment webhook events. Attackers can forge a charge.pending event containing attacker-controlled metadata and a charge object with status=succeeded and captured=true, causing the plugin to mark arbitrary pending WooCommerce orders as paid and trigger fulfillment flows with attacker-supplied transaction IDs. Exploitation is only possible if the merchant has not configured the webhook_secret_test or webhook_secret_live options, which are blank by default. Setting a non-empty webhook secret enables signature verification that blocks this attack.
Potential Impact
An attacker can bypass authorization to mark pending WooCommerce orders as paid without actual payment, potentially causing fraudulent order fulfillment. This impacts the integrity of order payment status but does not affect confidentiality or availability. The vulnerability requires the webhook secret to be unset, which is the default plugin configuration, increasing exposure risk until properly configured.
Mitigation Recommendations
Merchants should immediately configure a non-empty webhook_secret_test or webhook_secret_live option with the Stripe-issued whsec_ value to enable signature verification and prevent unauthorized webhook event processing. This configuration change effectively mitigates the vulnerability. No official patch or update is indicated; the fix relies on proper webhook secret configuration.
CVE-2026-12654: CWE-862 Missing Authorization in paymentplugins Payment Plugins for Stripe WooCommerce
Description
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12654 is an authorization bypass vulnerability (CWE-862) in the Payment Plugins for Stripe WooCommerce WordPress plugin. The plugin fails to properly verify user authorization when processing asynchronous payment webhook events. Attackers can forge a charge.pending event containing attacker-controlled metadata and a charge object with status=succeeded and captured=true, causing the plugin to mark arbitrary pending WooCommerce orders as paid and trigger fulfillment flows with attacker-supplied transaction IDs. Exploitation is only possible if the merchant has not configured the webhook_secret_test or webhook_secret_live options, which are blank by default. Setting a non-empty webhook secret enables signature verification that blocks this attack.
Potential Impact
An attacker can bypass authorization to mark pending WooCommerce orders as paid without actual payment, potentially causing fraudulent order fulfillment. This impacts the integrity of order payment status but does not affect confidentiality or availability. The vulnerability requires the webhook secret to be unset, which is the default plugin configuration, increasing exposure risk until properly configured.
Mitigation Recommendations
Merchants should immediately configure a non-empty webhook_secret_test or webhook_secret_live option with the Stripe-issued whsec_ value to enable signature verification and prevent unauthorized webhook event processing. This configuration change effectively mitigates the vulnerability. No official patch or update is indicated; the fix relies on proper webhook secret configuration.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-18T18:47:59.973Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a63164a9c2644c7f8878762
Added to database: 07/24/2026, 07:37:46 UTC
Last enriched: 07/24/2026, 07:53:41 UTC
Last updated: 07/24/2026, 21:00:54 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.