CVE-2026-12654

Name of the Vulnerable Software and Affected Versions Payment Plugins for Stripe WooCommerce versions prior to 4.0.8

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can mark pending asynchronous WooCommerce orders as paid by forging a charge.pending event. This is achieved by controlling the metadata.order id and metadata.gateway id variables, and providing a charge object with status=succeeded and captured=true. This process triggers the payment complete() function and subsequent fulfillment flows using a transaction ID supplied by the attacker. This issue is exploitable if the merchant has left the webhook secret test or webhook secret live options blank, which is the default configuration.

Recommendations Update to a version newer than 4.0.7. Manually configure a Stripe-issued whsec value in the webhook secret test or webhook secret live options to enable signature verification.