Payment Plugins for Stripe WooCommerce allows unauthenticated attackers to impersonate the Stripe webhook when the plugin’s webhook secret options are left blank. The plugin fails to verify that the request originates from a legitimate source, enabling the attacker to send a fabricated charge.pending event containing an arbitrary order_id, gateway_id and a charge object with status=succeeded and captured=true. This triggers the payment_complete() routine and downstream fulfillment, effectively marking the order as paid with the attacker‑supplied transaction ID. The weakness is an authorization bypass (CWE‑862).

All releases of the Payment Plugins for Stripe WooCommerce plugin up to and including version 4.0.7 are affected when the webhook_secret_test or webhook_secret_live fields are left empty. The plugin is available for WordPress installations using WooCommerce; any site that has installed a vulnerable version with default (blank) webhook secrets is vulnerable.

With a CVSS score of 5.3, the flaw is considered moderate severity. The EPSS score is below 1 %, indicating that the probability of exploitation is low, yet the vulnerability exists in the plugin’s default configuration, which many merchants may leave unchanged. The flaw is not listed in CISA’s KEV catalog, reducing its prominence in known exploit databases. Attackers who succeed can cause financial loss by making orders appear paid without authorization, potentially triggering shipping and invoicing.