CVE-2026-110285: WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

Q: Are sites using the plugin's default configuration affected?

Yes. The signing secret is unset by default, and in that state the plugin does not verify Stripe webhook signatures.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can forge a payment-completion notification, causing a completed order to be created without payment.

Q: What can be done if updating immediately is not possible?

Configure a Stripe webhook signing secret so that webhook signatures can be verified. The affected behavior occurs when no signing secret is configured.

Q: How can I determine whether my site is exposed?

Check the installed WP Stripe Checkout version and its webhook signing-secret configuration. Versions before 1.2.2.62 with no signing secret configured are affected.

Published Oct 25, 2026

Updated

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

Affected Software

1 affected component

WordPress WP Stripe Checkout<1.2.2.62

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Stripe Checkout to a version that resolves this vulnerability.
Fixed in 1.2.2.62

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Are sites using the plugin's default configuration affected?

Yes. The signing secret is unset by default, and in that state the plugin does not verify Stripe webhook signatures.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can forge a payment-completion notification, causing a completed order to be created without payment.

What can be done if updating immediately is not possible?

Configure a Stripe webhook signing secret so that webhook signatures can be verified. The affected behavior occurs when no signing secret is configured.

How can I determine whether my site is exposed?

Check the installed WP Stripe Checkout version and its webhook signing-secret configuration. Versions before 1.2.2.62 with no signing secret configured are affected.

CVE-2026-110285: WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

Affected Software

Remediation

Event History

Frequently Asked Questions

Are sites using the plugin's default configuration affected?

What does an attacker need to exploit this issue?

What can be done if updating immediately is not possible?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Are sites using the plugin's default configuration affected?

What does an attacker need to exploit this issue?

What can be done if updating immediately is not possible?

How can I determine whether my site is exposed?