CVE-2026-5167 is an authorization bypass vulnerability in the Masteriyo LMS WordPress plugin caused by improper verification of webhook signatures in the handle_webhook() function. The webhook endpoint processes requests without authentication and only verifies the signature if the webhook_secret setting is configured and the HTTP_STRIPE_SIGNATURE header is present. Because webhook_secret defaults to an empty string, the plugin accepts attacker-controlled JSON payloads without verification. This allows unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id metadata, marking orders as completed without payment and gaining unauthorized access to paid courses.

An attacker can bypass authorization controls by exploiting the lack of webhook signature verification, allowing them to mark orders as paid without actual payment. This leads to unauthorized access to paid course content, resulting in potential revenue loss and content exposure. There is no impact on confidentiality or availability reported, but integrity is compromised due to unauthorized order completion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure the webhook_secret setting is properly configured with a strong secret value to enforce signature verification. Disabling or restricting access to the webhook endpoint may also reduce risk. Monitor official vendor channels for updates or patches addressing this vulnerability.