The CVE describes a webhook authentication bypass in the Payment Plugins for Stripe WooCommerce (versions up to 4.0.7), assigning it a CVSS 5.3 MEDIUM rating. That score is dangerously misleading, and here's why: the plugin ships with blank webhook secrets by default, meaning any unauthenticated attacker who knows the plugin exists and understands WooCommerce order ID formatting can inject forged payment events that trigger real fulfillment — no secret required, no sophistication needed.
The CVSS vector treats this as a configuration issue to be scored locally, but the environmental condition is the out-of-box state. Tens of thousands of merchants have installed this plugin and seen payments work — the plugin processes payments fine without a configured webhook secret. The merchant receives zero feedback that they're accepting unauthenticated event injection. No warning in the admin panel. No blocking behavior on event processing. No visible indicator that fulfillment is gated on an external configuration they may not have known existed. The cognitive model a merchant builds is "this is configured and functional," and the plugin never challenges that model.
What makes this critical is the downstream blast radius. When an attacker forges a payment_complete event, the cascade propagates through the entire fulfillment stack: inventory decrements, shipping labels generate, customer notification emails fire, warehouse picking systems process the order. But there's a deeper problem: attackers can control metadata.order_id and metadata.gateway_id to direct fraudulent orders to real addresses of real people who ordered nothing. This creates consumer protection liability for the merchant and "fraudulent receipt" scenarios where confused recipients receive unexpected merchandise.
For defenders: check whether your installation has a configured Stripe webhook secret in the plugin settings — if that field is blank, you're accepting unauthenticated events. Scan your /wp-content/plugins/ directory for deactivated or abandoned Stripe-related plugins; deactivated is not eradicated, and old webhook endpoints may still be reachable. If you use this plugin, treat any unconfigured installation as actively exploitable rather than a low-priority finding. The historical pattern in this plugin ecosystem shows automated exploitation tooling emerging within 2-4 weeks of disclosure for vulnerabilities with similar default-insecure profiles.
The uncomfortable question is how many installations remain at the blank secret default with no visibility into that population. That epistemic gap should factor into your threat model — unanswerable usually means larger than you'd expect.