CVE-2026-9832 json
Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
published 2026-09-19 50 d ago modified 2026-09-21 48 d ago also EUVD-2026-83540
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\Stripe\Webhook::constructEvent()` is enforced and forged requests are rejected.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 50 d ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- themehigh Payment Gateway of Stripe for WooCommerce
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
- wordfence.com /threat-intel/vulnerabilities/id/2cef154c-efb8-4455-9be6-e3cf8b95e9d3?source=cve
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handle
- plugins.trac.wordpress.org /changeset?reponame=&old=3575195%40payment-gateway-stripe-and-woocommerce-integration&new=3575195%40payment-ga
Sources
- CVE List CVE-2026-9832
- NVD CVE-2026-9832
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.