---
id: CVE-2026-110285
title: >-
  WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via
  an Unset Webhook Signing Secret
summary: >-
  The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the
  Stripe webhook signature when no signing secret is configured, which is its
  default state, allowing unauthenticated attackers to forge a payment
  completion notif…
severity: none
cwe:
  - CWE-287
product: WP Stripe Checkout
affected:
  - wp_stripe_checkout < 1.2.2.62
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T06:00:19.779Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110285'
references:
  - url: 'https://wpscan.com/vulnerability/0f32d471-2806-4271-9a82-87895ef903ae/'
tags:
  - cve.org
epss: 0.00149
epssPercentile: 0.04013
ingestedAt: '2026-10-25T22:08:29.965Z'
---

## Overview

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

## Affected

- `wp_stripe_checkout < 1.2.2.62`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.