CVE-2026-9832: Stripe for WooCommerce Auth Bypass Flaw

CVE-2026-9832 Overview

CVE-2026-9832 affects the Payment Gateway of Stripe for WooCommerce plugin for WordPress in all versions up to and including 5.0.8. The plugin exposes a public webhook endpoint at woocommerce_api_wt_stripe that forwards to EH_Stripe_Webhook_Handler::handle(). The handler wraps the call to \Stripe\Webhook::constructEvent() inside an if (!empty($endpoint_secret)) guard. On fresh installations the eh_stripe_webhook_secret option is empty, so signature verification never executes. Unauthenticated attackers can send forged Stripe events to manipulate WooCommerce order state. The vulnerability is classified under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Unauthenticated attackers can forge Stripe webhook events to mark unpaid orders as paid, fail legitimate orders, fabricate disputes, and inject refund events on sites where an administrator has not configured a Stripe webhook signing secret.

Affected Products

Payment Gateway of Stripe for WooCommerce plugin (payment-gateway-stripe-and-woocommerce-integration) versions ≤ 5.0.8
WordPress sites running WooCommerce with this plugin installed
Deployments where the eh_stripe_webhook_secret option remains empty (default post-install state)

Discovery Timeline

2026-09-19 - CVE-2026-9832 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-9832

Vulnerability Analysis

The plugin registers a publicly accessible webhook endpoint via the WooCommerce API action woocommerce_api_wt_stripe. Requests to this endpoint are routed to EH_Stripe_Webhook_Handler::handle(). The handler retrieves the stored eh_stripe_webhook_secret option and only invokes \Stripe\Webhook::constructEvent() when the secret value is non-empty. When the secret is unset, the handler skips signature validation entirely and decodes the raw POST body as a trusted Stripe event object.

Because the option defaults to an empty string after installation, any request payload the attacker supplies is processed as an authentic Stripe event. The handler then dispatches the event to internal order-processing routines, including payment_complete() for order fulfillment updates. No authentication, capability check, or nonce protects the endpoint.

Root Cause

The root cause is a fail-open control flow. Signature verification is treated as optional and gated on operator configuration rather than enforced as a security invariant. The correct pattern is to reject webhook traffic outright when no signing secret is configured, or to refuse to process the payload until verification succeeds. See the vulnerable code at class-eh-stripe-webhook-handler.php L18 and L66.

Attack Vector

An unauthenticated remote attacker sends an HTTP POST request to the site's WooCommerce API endpoint targeting the wt_stripe handler. The request body contains a JSON payload structured as a Stripe event, such as charge.succeeded, charge.refunded, charge.dispute.created, or payment_intent.payment_failed. The attacker references a target order identifier known or guessed from the shop. The handler decodes the payload, matches it to an existing WooCommerce order, and updates order state accordingly. Attackers can mark unpaid orders as paid, force legitimate orders into a failed state, fabricate dispute notifications, or inject forged refunds.

No synthetic exploit code is included. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-9832

Indicators of Compromise

POST requests to /?wc-api=wt_stripe or /wc-api/wt_stripe from unexpected source IP addresses that do not resolve to Stripe's published webhook ranges.
WooCommerce orders transitioning to completed or processing status without a matching Stripe charge ID in the merchant Stripe Dashboard.
Order notes referencing Stripe events with livemode: false or event IDs that cannot be located in the Stripe API.
Sudden creation of dispute or refund order notes without corresponding entries in the Stripe Dashboard.

Detection Strategies

Inspect web server access logs for unauthenticated POST traffic to the wt_stripe WooCommerce API endpoint and correlate source IPs against Stripe's documented webhook egress addresses.
Reconcile WooCommerce order status changes against Stripe Dashboard events to identify state transitions with no authoritative Stripe record.
Audit the WordPress wp_options table for the eh_stripe_webhook_secret value and flag sites where the option is empty while the plugin is active.

Monitoring Recommendations

Enable WooCommerce order audit logging and forward events to a centralized SIEM for correlation with payment processor telemetry.
Alert on any refund, dispute, or payment_complete action that lacks a verifiable Stripe event ID.
Monitor plugin version inventory across WordPress estates to detect installations pinned at or below version 5.0.8.

How to Mitigate CVE-2026-9832

Immediate Actions Required

Configure a Stripe webhook signing secret in the plugin settings so that the eh_stripe_webhook_secret option is populated. Once set, \Stripe\Webhook::constructEvent() is enforced and forged requests are rejected.
Audit recent WooCommerce orders for unexpected status transitions, refunds, or disputes and reconcile them against the Stripe Dashboard.
Restrict access to the wt_stripe webhook endpoint at the web application firewall to Stripe's published IP ranges until remediation is verified.

Patch Information

At the time of publication, the vendor's public commits through version 5.0.8 still contain the vulnerable if (!empty($endpoint_secret)) guard, as shown in the v5.0.8 handler source. Administrators should monitor the WordPress Plugin Changeset and the Wordfence Vulnerability Report for the fixed release and update immediately when it is published.

Workarounds

Set a valid Stripe webhook signing secret in the plugin configuration to force signature verification on every inbound event.
Block or rate-limit unauthenticated POST requests to /?wc-api=wt_stripe at the reverse proxy or WAF layer, allowlisting only Stripe's documented webhook source IPs.
Deactivate the plugin on sites that do not actively process Stripe payments until a fixed version is available.

bash

# Example nginx snippet to restrict the vulnerable endpoint to Stripe IP ranges
location ~ ^/(\?wc-api=wt_stripe|wc-api/wt_stripe) {
    allow 3.18.12.0/24;      # Replace with Stripe's current published webhook ranges
    allow 3.130.192.0/24;
    deny all;
    proxy_pass http://wordpress_backend;
}