Live › vulnerability › CVE-2026-110285
Go to dashboardThe WP Stripe Checkout WordPress plugin skips Stripe webhook signature checks when no signing secret is set, which is the default. An unauthenticated attacker can send a fake payment-completed notification and get an order marked complete without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the WP Stripe Checkout plugin before that accept Stripe webhooks at a public endpoint and have no signing secret configured, which is the default state. Sites that do not use this plugin, or that already set a signing secret, are not exposed by this flaw.
1.2.2.62No product ranges from the sources yet.
wp plugin get wp-stripe-checkout --field=version1.2.2.62 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.
This page as .md · .json · in your agent: get_signal("CVE-2026-110285")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.