CVE-2026-9832

Overview

The Stripe for WooCommerce plugin for WordPress fails to verify cryptographic signatures on webhook requests when the webhook signing secret is unconfigured. This allows unauthenticated external actors to send forged webhook events and manipulate e-commerce order statuses.

Description

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\Stripe\Webhook::constructEvent()` is enforced and forged requests are rejected.

Impact

Unauthenticated attackers can forge Stripe webhook events to arbitrarily alter order statuses, marking unpaid goods as paid, causing legitimate orders to fail, or injecting fake refunds and dispute notifications. This directly impacts store integrity and financial operations for merchants running default, unconfigured installations.

Remediation

Update the Stripe for WooCommerce plugin to a version patched against this issue. Immediately configure and save a valid Stripe webhook signing secret in the plugin settings to enforce cryptographic signature verification on all incoming webhook traffic.

Risk context

The vulnerability carries a CVSS v3 score of 5.3 (Medium) with a low EPSS score of 0.00226, indicating low current exploitation activity. However, the requirement for administrative misconfiguration (an empty webhook secret) makes it a critical checklist item for hardening e-commerce environments.

Affected products

• Stripe for WooCommerce plugin <= 5.0.8
• WordPress