CVE-2026-12654 is an authorization bypass vulnerability (CWE-862) in the Payment Plugins for Stripe WooCommerce WordPress plugin, affecting all versions up to 4.0.7. The plugin fails to properly verify user authorization when processing asynchronous payment webhook events. Attackers can forge a charge.pending event with crafted metadata and a charge object indicating a successful and captured payment, causing the plugin to mark arbitrary pending orders as paid and trigger fulfillment flows with attacker-supplied transaction IDs. This exploit is only possible if the merchant has not configured the webhook_secret_test or webhook_secret_live options, which are blank by default. Setting a valid Stripe-issued webhook secret enables signature verification that blocks unauthorized webhook events.

An attacker can bypass authorization controls to mark arbitrary pending WooCommerce orders as paid without actual payment, potentially leading to fraudulent order fulfillment. This impacts the integrity of order payment status but does not directly affect confidentiality or availability. The vulnerability requires the merchant to have left the webhook secret unset, which is the default configuration, increasing exposure risk until properly configured.

Merchants should immediately configure the webhook_secret_test or webhook_secret_live option with the Stripe-issued whsec_ secret to enable signature verification of webhook events. This prevents unauthorized webhook event processing and blocks the authorization bypass. Since this setting is blank by default, manual configuration is required. No official patch or update is currently indicated; therefore, setting the webhook secret is the primary mitigation.