Which versions of BeikeShop are affected by CVE-2026-11462?

BeikeShop e-commerce platform versions 1.6.0.22 and earlier contain improper authorization in Stripe webhook processing that allows remote attackers to forge payment callbacks and mark unpaid orders…. A patch is available.

Is there a public PoC exploit available for CVE-2026-11462?

Yes, a public proof-of-concept exploit is available for CVE-2026-11462. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11462?

Within 24 hours: Identify all BeikeShop instances in production running version 1.6.0.22 or earlier and assess internet exposure. Within 7 days: Apply vendor-released patch per BeikeShop security advisory and verify Stripe-Signature header validation is enforced on all incoming webhooks. Within 30 days: Conduct financial audit of orders processed during vulnerability exposure window to detect and reverse fraudulent paid-order claims.

BeikeShop CVE-2026-11462

Q: What is the CVSS score of CVE-2026-11462?

CVE-2026-11462 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34993 MEDIUM

Improper Authorization (CWE-285)

2026-06-07 VulDB

GHSA-mvx3-fx3g-c4c2

PHP Authentication Bypass Beikeshop

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 23:22 NVD

HIGH MEDIUM

CVSS changed

Jun 07, 2026 - 23:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Source Code Evidence Fetched

Jun 07, 2026 - 22:43 vuln.today

Analysis Generated

Jun 07, 2026 - 22:43 vuln.today

DescriptionCVE.org

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper authorization. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 6719e0fc690ea0a998452092862e0f0a17c65968. It is suggested to install a patch to address this issue.

AnalysisAI

Improper authorization in the BeikeShop e-commerce platform (versions up to 1.6.0.22) allows remote unauthenticated attackers to forge Stripe payment webhook callbacks and mark unpaid orders as paid. The flawed callback function in plugins/Stripe/Controllers/StripeController.php accepts arbitrary request bodies without verifying the Stripe-Signature header, and publicly available exploit code exists on GitHub. CVSS is 7.3 with EPSS not provided; the issue is not in CISA KEV but has a public POC, raising the practical risk for any internet-exposed BeikeShop store.

Technical ContextAI

BeikeShop is a PHP/Laravel-based open-source e-commerce platform developed by Chengdu Everbrite Network Technology. The vulnerability resides in the Stripe payment plugin's webhook callback handler. The pre-patch code called $request->all() and trusted the JSON body to identify the order number and event type, then updated order/payment state accordingly. Stripe's documented integration model requires the receiver to call \Stripe\Webhook::constructEvent() with the raw payload, the Stripe-Signature header, and a configured whsec_ signing secret to cryptographically verify HMAC-SHA256 authenticity. Because BeikeShop omitted this verification, any HTTP client could submit a forged JSON payload to the /callback/stripe endpoint. This is a textbook CWE-285 (Improper Authorization) where the authorization decision (treating a webhook as a legitimate Stripe notification) is made without an authentication check on the request origin.

RemediationAI

Apply the upstream fix from commit 6719e0fc690ea0a998452092862e0f0a17c65968 (https://github.com/beikeshop/beikeshop/commit/6719e0fc690ea0a998452092862e0f0a17c65968) or upgrade to the first BeikeShop release that includes it once published - note that the input data confirms an upstream commit but does not name a tagged patched release, so verify with the vendor before declaring a specific fixed version. After patching, configure a valid Stripe whsec_ signing secret in the plugin settings (the patched code refuses to process callbacks when the secret is empty). If immediate patching is not possible, compensating controls include restricting access to the /callback/stripe route at the WAF or reverse proxy so only Stripe's documented webhook source IP ranges can reach it (trade-off: requires maintaining Stripe's IP list and may break legitimate deliveries during Stripe infrastructure changes), temporarily disabling the Stripe plugin and processing payments through an alternate gateway (trade-off: revenue loss), or adding an upstream HMAC validator that mirrors Stripe's signature check before traffic reaches PHP (trade-off: extra moving part to maintain).