BeikeShop CVE-2026-11462

The target must be running BeikeShop ≤ 1.6.0.22 with the bundled Stripe payment plugin enabled and the public /callback/stripe webhook route reachable from the internet (the default deployment exposes it so Stripe can deliver callbacks). The attacker must know or be able to guess/enumerate a valid order_number for an unpaid order they wish to fraudulently mark paid; no credentials, user interaction, or non-default settings are required beyond the plugin being active. Stores not using the Stripe plugin, or stores already on the patched commit with a configured whsec_ webhook secret, are not exploitable via this path.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L correctly reflects a remotely reachable, unauthenticated, low-complexity attack with limited-but-real impact on each CIA axis - appropriate because the attacker cannot read arbitrary data or take over the host, but can manipulate order/payment state. The E:P/RL:O/RC:C temporal metrics indicate a proof-of-concept exploit, an official fix, and confirmed reporting, which aligns with the published GitHub POC at nuiifornet/BeikeShop-Vulnerability and the vendor commit 6719e0fc. EPSS and CISA KEV data are not provided in the input, so widespread mass-exploitation cannot be confirmed; however, the financial motivation (free goods) combined with a trivial single-request exploit makes opportunistic abuse plausible against any internet-exposed installation. Net real-world priority is moderate-to-high for any merchant running BeikeShop ≤ 1.6.0.22 with the Stripe plugin enabled, despite the CVSS being only 7.3.

An attacker browses a BeikeShop storefront, initiates a normal Stripe checkout to learn the order_number format, then aborts payment. Using the public POC at https://github.com/nuiifornet/BeikeShop-Vulnerability, they send a single crafted JSON POST to /callback/stripe containing a checkout.session.completed-style event and the victim's order_number in data.object.metadata.order_number, with no Stripe-Signature header. The unpatched controller accepts the body, marks the order as paid, and the attacker receives the goods or service without payment.