Technical impact
The WP Stripe Checkout plugin for WordPress fails to verify the Stripe webhook signature when no signing secret is configured, which is the default state. As a result, unauthenticated attackers can forge a payment completion notification, causing the system to create a completed order without any actual payment. This does not compromise user credentials or confidentiality but directly impacts the integrity of transaction records and can result in significant financial loss for the site owner.
Affected Systems
This vulnerability affects the WP Stripe Checkout WordPress plugin for all versions prior to 1.2.2.62. The affected product is the plugin itself, with the specific vulnerable release line being any installation older than 1.2.2.62.
Risk and Exploitability
Based on the description, it is inferred that the attacker can send a crafted HTTP request that mimics a Stripe webhook to the plugin endpoint because the plugin does not validate the signature when no signing secret is configured. This lack of authentication allows the order to be marked as paid. The EPSS score is less than 1%, indicating a very low exploitation probability, but the absence of signature verification makes the vulnerability moderately exploitable. The CVSS score of 5.3 reflects moderate severity. It is not yet listed in CISA's KEV catalog, yet the risk of financial exploitation remains due to the low effort required to craft the request.
