CVE-2026-110285— WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
Quick assessment
Affected
Unknown WP Stripe Checkout
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 1.2.2.62 版本之前的 WP Stripe Checkout WordPress 插件，在未配置签名密钥（其默认状态）时，未验证 Stripe 网络钩子（webhook）的签名。这使得未经身份验证的攻击者能够伪造支付完成通知，从而在无需实际付款的情况下创建已完成订单。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110285
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Stripe Checkout | 0 ~ 1.2.2.62 | - |
|
II. Public POCs for CVE-2026-110285
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110285
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total
| CVE-2026-114743 | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin | |
| CVE-2026-115183 | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget | |
| CVE-2026-115214 | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol | |
| CVE-2026-115251 | Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click | |
| CVE-2026-114742 | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR | |
| CVE-2026-114740 | WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar | |
| CVE-2026-114741 | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR | |
| CVE-2026-111979 | GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color | |
| CVE-2026-111980 | GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability | |
| CVE-2026-111981 | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad | |
| CVE-2026-111978 | GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import | |
| CVE-2026-111976 | GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou | |
| CVE-2025-15705 | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS | |
| CVE-2026-94295 | Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-114743
InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Up -
CVE-2026-115183
Qi Addons For Elementor < 1.11.2 - Contributor+ Content Inje -
CVE-2026-115214
Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege -
CVE-2026-115251
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PH -
CVE-2026-114742
WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via