{"id":"CVE-2026-110285","kind":"vulnerability","aliases":["CVE-2026-110285"],"related":[],"title":"WP Stripe Checkout WordPress plugin: forged webhooks create unpaid completed orders","description":"The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.","summary":"The WP Stripe Checkout WordPress plugin skips Stripe webhook signature checks when no signing secret is set, which is the default. An unauthenticated attacker can send a fake payment-completed notification and get an order marked complete without paying.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","stripe","wordpress","wp-stripe-checkout"],"not_affected_if":["plugin-not-installed","plugin-updated","signing-secret-configured"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get wp-stripe-checkout --field=version`\n- Check whether a Stripe webhook signing secret is configured in the plugin settings (unknown if the sources name the exact option)","fix":"- Update the WP Stripe Checkout plugin to `1.2.2.62` or later\n- Configure a Stripe webhook signing secret in the plugin settings (unknown if the sources name the exact option)","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:44+00:00","updated_at":"2026-10-25T06:37:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T06:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Stripe Checkout plugin to `1.2.2.62` or later\n- Configure a Stripe webhook signing secret in the plugin settings (unknown if the sources name the exact option)","reach":"internet","title":"WP Stripe Checkout WordPress plugin: forged webhooks create unpaid completed orders","impact":"medium","summary":"The WP Stripe Checkout WordPress plugin skips Stripe webhook signature checks when no signing secret is set, which is the default. An unauthenticated attacker can send a fake payment-completed notification and get an order marked complete without paying.","category":"package","nicknames":[],"who_cares":["wordpress","wp-stripe-checkout","stripe","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker creates completed orders without paying","analyst_note":"Confirm the exact settings field name for the signing secret and the plugin slug from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get wp-stripe-checkout --field=version`\n- Check whether a Stripe webhook signing secret is configured in the plugin settings (unknown if the sources name the exact option)","needs_analyst":true,"not_affected_if":["plugin-updated","signing-secret-configured","plugin-not-installed"],"who_is_affected":"Sites running the WP Stripe Checkout plugin before `1.2.2.62` that accept Stripe webhooks at a public endpoint and have no signing secret configured, which is the default state. Sites that do not use this plugin, or that already set a signing secret, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000643,"input_tokens":3309,"output_tokens":624,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110285':14A,17A '-2026':13A,16A '1.2.2.62':73C 'allow':92C 'attack':49B,94C 'check':36B 'checkout':3A,25B,29B,69C 'complet':10A,56B,63B,99C,104C 'configur':86C 'creat':8A,102C 'cve':12A,15A 'default':46B,90C 'ecommerc':18B 'fake':53B 'forg':6A,96C 'get':59B 'mark':62B 'notif':57B,100C 'order':11A,61B,105C 'packag':19B 'pay':65B,107C 'payment':55B,98C 'payment-complet':54B 'plugin':5A,31B,71C 'secret':40B,84C 'send':51B 'set':42B 'sign':39B,83C 'signatur':35B,80C 'skip':32B 'state':91C 'stripe':2A,20B,24B,28B,33B,68C,78C 'unauthent':48B,93C 'unpaid':9A 'verifi':76C 'webhook':7A,34B,79C 'without':64B,106C 'wordpress':4A,21B,30B,70C 'wp':1A,23B,27B,67C 'wp-stripe-checkout':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Stripe Checkout plugin before `1.2.2.62` that accept Stripe webhooks at a public endpoint and have no signing secret configured, which is the default state. Sites that do not use this plugin, or that already set a signing secret, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110285","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}