---
id: "CVE-2026-110285"
kind: "vulnerability"
aliases: ["CVE-2026-110285"]
title: "WP Stripe Checkout WordPress plugin: forged webhooks create unpaid completed orders"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "stripe", "wordpress", "wp-stripe-checkout"]
not_affected_if: ["plugin-not-installed", "plugin-updated", "signing-secret-configured"]
published_at: "2026-10-25T06:16:31+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110285", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# WP Stripe Checkout WordPress plugin: forged webhooks create unpaid completed orders

The WP Stripe Checkout WordPress plugin skips Stripe webhook signature checks when no signing secret is set, which is the default. An unauthenticated attacker can send a fake payment-completed notification and get an order marked complete without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get wp-stripe-checkout --field=version`
- Check whether a Stripe webhook signing secret is configured in the plugin settings (unknown if the sources name the exact option)

## Fix

- Update the WP Stripe Checkout plugin to `1.2.2.62` or later
- Configure a Stripe webhook signing secret in the plugin settings (unknown if the sources name the exact option)

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110285

## From the sources

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_