Threats tagged 'ghsa-vq2h-2cv6-5rpj'

WP Stripe Checkout versions before 1.2.2.62 do not verify Stripe webhook signatures when no signing secret is configured, which is the default setting. This improper authentication allows unauthenticated attackers to forge payment completion notifications and create completed orders without actual payment.