The Payment Gateway of Stripe for WooCommerce plugin improperly verifies cryptographic signatures on Stripe webhook events due to the webhook endpoint handler bypassing signature verification when the webhook signing secret is unset (empty). Specifically, the `woocommerce_api_wt_stripe` endpoint calls `\Stripe\Webhook::constructEvent()` only if the `eh_stripe_webhook_secret` option is non-empty. On default installations, this option is empty, so the plugin processes raw POST bodies as trusted events without signature verification. This allows unauthenticated attackers to forge Stripe webhook events to manipulate WooCommerce order statuses and related payment states. The vulnerability is present in all versions up to and including 5.0.8 and is remediated by configuring a valid webhook signing secret, which enforces signature verification.

An attacker can send forged Stripe webhook events without authentication to the WooCommerce plugin, potentially causing unauthorized changes to order statuses. This includes marking unpaid orders as paid or completed, forcing legitimate orders into failed states, fabricating dispute notifications, and injecting fake refund events. The impact is limited to integrity of order/payment status within WooCommerce and does not affect confidentiality or availability. The vulnerability is exploitable only if the Stripe webhook signing secret is not configured.

Administrators must configure a valid Stripe webhook signing secret in the plugin settings to enable signature verification on incoming webhook events. Once configured, the plugin enforces cryptographic signature checks via `\Stripe\Webhook::constructEvent()`, rejecting forged requests. No patch version is explicitly stated, but configuring the webhook secret fully mitigates the vulnerability. No additional action is required if the secret is already set.