Description

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\Stripe\Webhook::constructEvent()` is enforced and forged requests are rejected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T08:16:55.340Z",
  "pubdate": "2026-09-19T08:16:55.340Z",
  "executiveSummary": "The Payment Gateway of Stripe for WooCommerce plugin is affected by an Improper Verification of Cryptographic Signature vulnerability in versions up to and including 5.0.8.\nThe flaw originates in the webhook handler logic, where signature verification is conditionally bypassed if the Stripe webhook signing secret is not explicitly configured.\nThis allows unauthenticated remote attackers to submit arbitrary, forged webhook payloads to the publicly accessible woocommerce_api_wt_stripe endpoint.\nSuccessful exploitation enables unauthorized manipulation of order lifecycle states, such as marking unpaid orders as paid or completed, triggering fraudulent refunds, or inducing order failures.\nThe vulnerability poses a critical risk to financial integrity and order management for any WooCommerce installation using the plugin where the endpoint secret remains unconfigured.\nThe exploitation requirement is limited to the absence of a configured webhook secret; once a valid secret is saved, the internal Stripe SDK mechanisms properly enforce signature validation.",
  "technicalDetails": "The root cause of the vulnerability resides in the EH_Stripe_Webhook_Handler::handle() method, which processes incoming POST requests sent to the woocommerce_api_wt_stripe endpoint. The implementation includes a conditional check: if (!empty($endpoint_secret)).\nIn a default or fresh installation of the Payment Gateway of Stripe for WooCommerce plugin, the eh_stripe_webhook_secret option remains empty by default. Consequently, the conditional check fails, bypassing the essential call to \\Stripe\\Webhook::constructEvent().\nThe \\Stripe\\Webhook::constructEvent() method is the standard security control provided by the Stripe PHP SDK to verify the authenticity and integrity of incoming webhook notifications via a cryptographic signature (the 'Stripe-Signature' header). By bypassing this method, the plugin treats the raw, attacker-controlled JSON payload as a trusted event sent directly from Stripe without any form of authentication or authorization.\nAn unauthenticated attacker can construct a crafted JSON payload simulating various Stripe events, such as 'payment_intent.succeeded', 'charge.refunded', or 'charge.failed'. Since there is no signature validation, the backend processes these payloads, passing the data directly to event-handling functions like payment_complete().\nThe attack flow proceeds as follows: 1) The attacker identifies a target site running an affected version of the plugin; 2) The attacker crafts a malicious HTTP POST request containing a forged Stripe webhook payload; 3) The request is directed to the public endpoint /?wc-api=woocommerce_api_wt_stripe; 4) The server receives the request and, due to the missing secret, proceeds to parse the payload without signature verification; 5) The plugin internal logic executes the action associated with the forged event.\nThe impact is severe, as an attacker can force arbitrary state changes in the WooCommerce order management system. By injecting a successful payment event, an attacker could fulfill orders without actual payment, potentially resulting in direct financial and inventory loss for the merchant. Conversely, by injecting failure or refund events, an attacker can perform a Denial of Service on individual orders or disrupt the accounting reconciliation process. This vulnerability remains latent until an administrator manually configures the webhook secret, which forces the code to enter the secure execution branch."
}