CVE-2026-9832

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9832", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-05-28T12:34:29.054Z", "datePublished": "2026-09-19T07:43:14.190Z", "dateUpdated": "2026-09-19T14:01:24.308Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-09-19T07:43:14.190Z"}, "affected": [{"vendor": "themehigh", "product": "Payment Gateway of Stripe for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\\Stripe\\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations \u2014 because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install \u2014 causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\\Stripe\\Webhook::constructEvent()` is enforced and forged requests are rejected."}], "title": "Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cef154c-efb8-4455-9be6-e3cf8b95e9d3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L93"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L18"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L321"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L93"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L18"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L321"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3575195%40payment-gateway-stripe-and-woocommerce-integration&new=3575195%40payment-gateway-stripe-and-woocommerce-integration"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-347 Improper Verification of Cryptographic Signature", "cweId": "CWE-347", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "pradeep suvarna"}], "timeline": [{"time": "2026-09-18T19:19:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-19T13:24:24.417063Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-19T14:01:24.308Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-19T13:24:24.417063Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-19T13:54:22.290Z"}}], "cna": {"title": "Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint", "credits": [{"lang": "en", "type": "finder", "value": "pradeep suvarna"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "themehigh", "product": "Payment Gateway of Stripe for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.0.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-09-18T19:19:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cef154c-efb8-4455-9be6-e3cf8b95e9d3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L93"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L18"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L321"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L93"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L18"}, {"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L321"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3575195%40payment-gateway-stripe-and-woocommerce-integration&new=3575195%40payment-gateway-stripe-and-woocommerce-integration"}], "descriptions": [{"lang": "en", "value": "The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\\Stripe\\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations \u2014 because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install \u2014 causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\\Stripe\\Webhook::constructEvent()` is enforced and forged requests are rejected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-09-19T07:43:14.190Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9832", "state": "PUBLISHED", "dateUpdated": "2026-09-19T14:01:24.308Z", "dateReserved": "2026-05-28T12:34:29.054Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-09-19T07:43:14.190Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Payment Gateway of Stripe for WooCommerce", "vendor": "themehigh", "versions": [{"lessThanOrEqual": "5.0.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\\Stripe\\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations \u2014 because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install \u2014 causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\\Stripe\\Webhook::constructEvent()` is enforced and forged requests are rejected."}], "id": "CVE-2026-9832", "lastModified": "2026-09-21T13:33:33.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9832", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-19T13:24:24.417063Z", "version": "2.0.3"}}]}, "published": "2026-09-19T08:16:55.340", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L18"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L321"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L66"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L93"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L18"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L321"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L66"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L93"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3575195%40payment-gateway-stripe-and-woocommerce-integration&new=3575195%40payment-gateway-stripe-and-woocommerce-integration"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cef154c-efb8-4455-9be6-e3cf8b95e9d3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.0.8]"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 83.0, "source": "matching"}]}, "original": {"product": "Payment Gateway of Stripe for WooCommerce", "source": "cna", "vendor": "themehigh"}, "product": "stripe_payment_gateway_for_woocommerce", "vendor": "themehigh"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.0.8]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}]}, "product": "payment_gateway_of_stripe_for_woocommerce", "vendor": "wordpress-extensions"}], "created": "2026-09-19T22:00:23.346309+00:00", "updated": "2026-09-28T19:49:08.495043+00:00", "vendors": ["themehigh", "themehigh$PRODUCT$stripe_payment_gateway_for_woocommerce", "wordpress-extensions", "wordpress-extensions$PRODUCT$payment_gateway_of_stripe_for_woocommerce"]}