WordPress Stripe Webhook Configuration Unauthorized Modification

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the `wp_ajax_pmpro_stripe_create_webhook`, `wp_ajax_pmpro_stripe_delete_webhook`, and `wp_ajax_pmpro_stripe_rebuild_webhook` AJAX handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete, create, or rebuild the site's Stripe webhook, disrupting all payment processing, subscription renewal synchronization, cancellation handling, and failed payment management.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Paid Memberships Pro plugin for WordPress contains a critical authorization bypass vulnerability affecting versions up to 3.6.5. Three AJAX handlers—wp_ajax_pmpro_stripe_create_webhook, wp_ajax_pmpro_stripe_delete_webhook, and wp_ajax_pmpro_stripe_rebuild_webhook—lack proper capability checks, allowing any authenticated user with Subscriber-level access or higher to manipulate Stripe webhook configurations. This vulnerability matters because webhooks are the communication channel between Stripe and your e-commerce platform; attackers can intercept payment notifications, redirect transaction data, or disable critical payment processing callbacks. WordPress sites running Paid Memberships Pro with Stripe integration and users who grant subscriber access to untrusted parties face immediate risk of payment processing disruption and potential fraud.

Casky's 261 matched skills leverage Claude AI's extended reasoning to detect the attack patterns underlying TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would identify suspicious activity through detection of AJAX requests to pmpro_stripe_* endpoints originating from low-privileged accounts, unauthorized webhook creation pointing to external domains, or rapid webhook deletion followed by reconstruction—all red flags for CWE-862 (Missing Authorization) exploitation. The platform's skill set maps these behavioral indicators to MITRE techniques, enabling security teams to correlate privilege abuse attempts with potential payment fraud schemes and credential harvesting through webhook manipulation before production impact occurs.

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4100.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-4100 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn