◆ CVE Hub

CVE-2026-110285

WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

Published
2026-10-25
Last modified
2026-10-25
CNA
WPScan
CWE
CWE-287

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed

Description

CNA (WPScan)

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownWP Stripe Checkout
affected: 0 … < 1.2.2.62
default: unaffected

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (1)