Vulnerability · Published Oct 25, 2026 · Assigned by WPScan
CVE-2026-110285WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
Medium 5.3
In plain English
A medium-severity improper authentication in WP Stripe Checkout from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Stripe Checkout | 0 – before 1.2.2.62 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/0f32d471-2806-4271-9a82-87895ef903ae/ exploit, vdb-entry, technical-description