CVE-2026-3177 describes an insufficient verification of data authenticity vulnerability in the Charitable – Donation Plugin for WordPress, specifically affecting versions up to 1.8.9.7. The issue arises from missing cryptographic verification of incoming Stripe webhook events, which enables unauthenticated attackers to forge payment_intent.succeeded webhook payloads. This can cause the plugin to incorrectly mark pending donations as completed without a legitimate payment transaction. The vulnerability is categorized under CWE-345 and has a CVSS 3.1 base score of 5.3 (medium severity). No patch or official remediation has been published by the vendor as of the provided data.

An attacker can exploit this vulnerability to forge Stripe webhook events, causing the plugin to mark donations as paid without actual payment. This could lead to financial discrepancies and fraudulent donation records. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling Stripe webhook processing or implementing additional verification controls externally to ensure webhook authenticity. Monitor vendor channels for updates.