The Masteriyo LMS plugin for WordPress processes Stripe webhook events without proper signature verification when the webhook_secret setting is empty. The handler accepts any POST request, and if a HTTP_STRIPE_SIGNATURE header is present it only verifies the signature if a secret is configured. Because the default secret value is an empty string, an unauthenticated attacker can craft a JSON payload with any order_id in the metadata and have the plugin record that order as completed, effectively bypassing payment and granting access to paid course content. This flaw represents an authorization bypass (CWE‑639).

All WordPress installations running Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin up to and including version 2.1.7 that have the Stripe addon enabled are impacted. The vulnerability resides in the StripeAddon.php file handling webhooks and affects any site that exposes this endpoint.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector likely involves sending an unauthenticated HTTP POST to the Stripe webhook URL from the public internet with a forged JSON payload containing a desired order_id. Successful exploitation allows an attacker to mark any order as completed without payment and gain unauthorized access to course materials.