A flaw in the WP Stripe Checkout WordPress plugin, versions before 1.2.2.62, skips verifying the Stripe webhook signature whenever a signing secret hasn't been set up, which happens to be the plugin's default state. That gap lets anyone send a fake payment-succeeded message straight to the site, marking an order as fully paid without any money changing hands. Store owners should update the plugin and configure webhook signing right away to close the hole.
// source: nvd.nist.gov ↗