CVE-2026-9832

Received Received - Intake

Improper Cryptographic Signature Verification in Stripe for WooCommerce

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\Stripe\Webhook::constructEvent()` is enforced and forged requests are rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-9832

Affected Vendors & Products

Vendor	Product	Version / Range
stripe	payment_gateway_for_woocommerce	to 5.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Stripe for WooCommerce plugin for WordPress. It allows unauthenticated attackers to send forged webhook events to manipulate order statuses without proper signature verification. The issue occurs because the plugin's webhook endpoint does not enforce cryptographic signature checks by default, enabling attackers to mark unpaid orders as paid or completed, fabricate disputes, or inject false refund events.

Detection Guidance

Check if the Stripe webhook signing secret is configured in WooCommerce. If the eh_stripe_webhook_secret option is empty, the vulnerability may exist. Inspect webhook logs for unsigned or forged Stripe events.

Impact Analysis

If exploited, this vulnerability could allow attackers to alter order statuses in WooCommerce, leading to financial losses or fraudulent transactions. Unpaid orders might be marked as paid, completed orders could be forced into a failed state, or fake dispute notifications could be generated. This impacts store owners using the plugin without configuring a webhook signing secret.

Compliance Impact

This vulnerability could lead to unauthorized manipulation of order statuses, payments, and refunds in WooCommerce via forged Stripe webhook events. This may result in improper handling of personal or financial data, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy) if such data is involved.

Mitigation Strategies

Immediately configure a valid Stripe webhook signing secret in the plugin settings to enforce signature verification. This prevents forged webhook events from being processed without proper authentication.

Hi! I’m here to help you understand CVE-2026-9832. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70