WooCommerce Stripe Plugin Missing Authorization to Modify Order Status (CVE-2026-12654)

Vulnerability Overview Vulnerability Name: Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret CVE ID: CVE-2026-12654 CVSS Score: 5.3 (Medium) Publish Date: July 23, 2026 Last Update Date: July 24, 2026 Researcher: gadget smith Affected Scope Software Type: Plugin Software Name: woo-stripe-payment Affected Versions: <= 4.0.7 Fixed Versions: 4.0.8 Remediation Recommendation: Upgrade to version 4.0.8 or a newer patched version. Description The Payment Plugins for Stripe WooCommerce plugin contains an authorization bypass vulnerability that allows an unauthenticated attacker to mark any pending asynchronous WooCommerce order as paid by forging a change object with attacker-controlled metadata order ID, metadata gateway ID, and a status of "succeeded" with capture set to "true". This leads to vulnerabilities in downstream fulfillment flows containing attacker-provided transaction IDs. Exploitation requires the merchant to leave the or option empty, which is the default state of the plugin until the Stripe value is issued. Once a non-empty key is set, signature verification cannot be bypassed. References plugins.trac.wordpress.org Additional Information License: Defiant grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, sublicense, and distribute the software vulnerability information. MITRE License: MITRE grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Contact Information Contact Email: wf-support@wordfence.com Business Hours Operating Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days/year, 1-hour response time Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media X (Twitter): X (Twitter) Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Product Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscription Updates Subscription Email: Subscription Email Agree to Terms: Agree to Terms Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Commerce: Commerce

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Stripe Plugin Missing Authorization to Modify Order Status (CVE-2026-12654)