Charitable Donation Plugin for WordPress Stripe Webhook Data Forgery Vulnerability

A vulnerability exists in the Charitable Donation Plugin for WordPress, specifically in versions up to and including 1.8.9.7. The issue arises from inadequate verification of data authenticity, as the plugin fails to apply cryptographic validation to incoming Stripe webhook events. This flaw enables unauthenticated attackers to fabricate 'payment_intent.succeeded' webhook payloads, falsely marking pending donations as completed without actual payment.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of donation statuses, potentially leading to financial discrepancies by falsely indicating that payments have been received.

Remediation

Users are advised to update the Charitable Donation Plugin for WordPress to version 1.8.10 or a newer patched version.