CVE-2026-5167 is an authorization bypass vulnerability in the Masteriyo LMS WordPress plugin (up to version 2.1.7) caused by insufficient verification of webhook signatures in the handle_webhook() function. The webhook endpoint accepts unauthenticated requests and only performs signature verification if both a webhook_secret is set and the HTTP_STRIPE_SIGNATURE header is present. Because the webhook_secret defaults to an empty string, the plugin processes attacker-controlled JSON payloads without verification. This allows unauthenticated attackers to forge Stripe webhook events with arbitrary order_id metadata, enabling them to mark orders as paid and access paid course content without authorization.

An attacker can bypass authorization controls by sending unauthenticated, forged Stripe webhook events to the Masteriyo LMS plugin. This can result in orders being marked as completed without actual payment, allowing unauthorized access to paid course content. The vulnerability impacts the integrity of order processing and access control within the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should ensure that the webhook_secret setting is properly configured with a strong secret value and verify that the HTTP_STRIPE_SIGNATURE header is required and validated. If possible, restrict access to the webhook endpoint to trusted IP addresses or implement additional verification controls. Monitor vendor channels for updates or patches addressing this vulnerability.