What is GHSA-vq2h-2cv6-5rpj?

GHSA-vq2h-2cv6-5rpj is a security advisory published by GitHub Security Advisories with Medium severity. The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook...

Which CVE IDs does GHSA-vq2h-2cv6-5rpj cover?

GHSA-vq2h-2cv6-5rpj covers the following CVE IDs: CVE-2026-110285. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vq2h-2cv6-5rpj?

GHSA-vq2h-2cv6-5rpj has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-vq2h-2cv6-5rpjMediumCVSS 5.3

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-110285 →

📋 Description

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110285
https://wpscan.com/vulnerability/0f32d471-2806-4271-9a82-87895ef903ae
https://github.com/advisories/GHSA-vq2h-2cv6-5rpj