WP Stripe Checkout EUVD-2026-109341

Exploitable only when the plugin is deployed without a configured Stripe webhook signing secret - which the advisory states is the default configuration - so default installations of WP Stripe Checkout before 1.2.2.62 are vulnerable out of the box. The specific trigger is the plugin's failure to verify the Stripe webhook signature, letting a crafted webhook be accepted. The primary limiting factor is that operators who have explicitly configured a signing secret are not affected; impact is also bounded to forging order/payment state (integrity) and does not expose data or disrupt availability.

This is a moderate-risk, business-logic authentication bypass (CWE-287) rather than a system-compromise flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) aligns well with the description: network-reachable, low-complexity, unauthenticated, with only limited integrity impact and no confidentiality or availability impact - consistent with forging an order state rather than taking over the host. The signals are internally coherent and point to low technical severity but real fraud/financial impact: EPSS is low (0.15%, 4th percentile), the issue is not in CISA KEV (no confirmed active exploitation), and only an unverified PoC reference (WPScan advisory) exists. The vuln.today decision label 'this_month' matches this picture - worth patching on a normal cycle, not an emergency. The practical priority is driven not by exploitation likelihood but by direct monetary loss: successful exploitation lets an attacker obtain goods/services marked as paid without payment. Because the vulnerable condition (no webhook signing secret configured) is stated to be the default state, every default install is affected, which raises exposure relative to the modest CVSS score.

An attacker identifies a store running WP Stripe Checkout in its default configuration (no Stripe webhook signing secret set) and crafts a fake Stripe 'payment completed' webhook event. They POST it to the plugin's unauthenticated webhook endpoint, which accepts it without signature verification, causing the plugin to mark an order as completed and release the goods or services without any real payment. An unverified public PoC reference exists via the WPScan advisory, but it is not confirmed as working exploit code.