Security Bulletin — July 24, 2026: Unpaid Orders Marked "Paid" — Payment Manipulation in the Stripe Plugin for WooCommerce, plus Privilege Escalation in EventON and Data Loss in Easy Appointments (CVE-2026-12654, CVE-2026-10033 & CVE-2026-8789)

This is our daily security overview, in which we review the published vulnerabilities and highlight those that are actually relevant for the operation of WordPress websites, online shops, and PHP applications. Every statement has been verified against the underlying primary source and linked at the end of the respective section. Today offers an instructive case for why a sober CVSS number does not always capture the business impact: the most serious report for shop operators carries only a medium score — and still lets an attacker pass off unpaid orders as paid. Alongside it are two further fresh entries that show how inconspicuous AJAX endpoints without an authorization check lead to privilege escalation and data loss.

Unpaid Orders Marked “Paid”: Manipulation in the Stripe Plugin for WooCommerce (CVE-2026-12654)

The free payment plugin Payment Plugins for Stripe WooCommerce integrates Stripe as a payment method into WooCommerce shops and runs on roughly 100,000 websites. In all releases up to and including version 4.0.7, the plugin does not adequately verify the authenticity of incoming Stripe webhook events. An attacker without any login can forge a charge.pending event and attach self-chosen metadata — the order ID, the gateway ID, and a charge object with the status “succeeded” or “captured.” The plugin then calls its completion routine payment_complete() and treats the affected order as fully paid, including the downstream fulfillment steps, with a transaction ID chosen by the attacker. Concretely: goods or services without any incoming payment. At CVSS 5.3 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) the numeric severity is only medium — solely because no data leaks and availability is untouched; for a shop the flaw is economically significant. The precondition is decisive: the attack only works while the webhook signing secret (webhook_secret_test or webhook_secret_live) is empty — and that is the shipped state until a Stripe-issued whsec_ value is entered by hand. Once a secret is stored, signature verification blocks the forged call. The corrected version 4.0.8 closes the flaw; anyone running 4.0.7 or older should update and configure the webhook signing secret in the Stripe dashboard.

Sources: NVD — CVE-2026-12654 · WordPress.org — Payment Plugins for Stripe WooCommerce

Unauthenticated Privilege Escalation in EventON Action User (CVE-2026-10033)

EventON Action User is an add-on to the EventON events calendar that manages user and role permissions. In all versions up to and including 2.5.14, the AJAX action evoau_save_capability does not check the caller’s authorization. This lets an attacker without a login grant EventON management rights and the file-upload capability (upload_files) to any non-administrator role or account; the administrator role itself is protected by an early-return guard in the code. The same path also allows enumerating all WordPress users (including IDs and display names), reading role and capability state as well as nonce values, and tampering with event-to-user assignments. The severity is CVSS 7.3 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Handing the file-upload capability to a low-privileged account is especially delicate, because it opens an attacker a further step toward a persistent foothold on the server. The issue is fixed in version 2.5.15.

Sources: NVD — CVE-2026-10033 · Wordfence — CVE-2026-10033

Data Loss Through a Missing Permission Check in Easy Appointments (CVE-2026-8789)

Easy Appointments is a widely used appointment and booking plugin (roughly 10,000 active installations). In all releases up to and including 3.12.27, the AJAX action ea_delete_multiple_connections lacks both a capability check and a nonce check. A logged-in user with contributor rights or above can thereby delete arbitrary records from the internal connections table (wp_ea_connections) — precisely the configuration that ties services, staff, and locations into bookable appointments. For a booking system, that is an immediate operational outage. At CVSS 8.1 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) this flaw carries the highest score of the day; its focus is on integrity and availability, not on data exposure. The developers fixed the issue in version 3.12.28.

Sources: NVD — CVE-2026-8789 · WordPress.org — Easy Appointments

Unsure whether you are affected? Get in touch.

---

This notice serves security-awareness purposes. The official advisories of the respective vendor and the primary sources linked above are always authoritative.