Payment Gateway Of Stripe For Woocommerce
Monthly
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Forged Stripe webhook events can be injected into sites running the ThemeHigh "Payment Gateway of Stripe for WooCommerce" plugin through version 5.0.8, allowing unauthenticated remote attackers to manipulate WooCommerce order state - marking unpaid orders as paid or completed, forcing legitimate orders into a failed state, fabricating dispute notices, and pushing forged refund events into the store's records. The flaw only exists in the default post-install configuration, where the eh_stripe_webhook_secret option is empty and the plugin's publicly reachable woocommerce_api_wt_stripe endpoint accepts the raw POST body as a trusted Stripe event without ever calling \Stripe\Webhook::constructEvent(); once an administrator saves any valid signing secret, forged requests are rejected. The integrity-only impact and CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understate operational risk for stores sitting on the unconfigured default; there is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).