Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
medium
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pendi...
- CVSS:
- 5.3
- Affected:
- up to 4.0.7
- Fixed in:
- 4.0.8
- Disclosed:
- Jul 23, 2026
CVE-2026-12654 on NVD →
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization
medium
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
- Affected:
- up to 4.0.7
- Fixed in:
- 4.0.8
- Disclosed:
- Jul 23, 2026
CVE-2026-59530 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database