Stripe for WooCommerce 10.8.5: what the security fix actually changes
WooCommerce emailed store owners yesterday about a security issue in its Stripe plugin, with the usual advice to update immediately. The changelog is one line long, there's no CVE, and there's no advisory explaining what was wrong.
So here's what's actually in it.
What shipped
Stripe for WooCommerce 10.8.5 was released on August 5, 2026 at 16:32 GMT. The public changelog says only: "Update - Improve webhook handling".
WordPress.org's update API is more direct. It carries this note against the release:
Version 10.8.5 contains security fixes and is highly recommended for all users.
Affected: every version below 10.8.5. If you take card payments through this plugin, you're in scope. There is one release line and no maintained older branch, so there is no back-ported fix to sit on.
Worth separating the numbers before going further. 10.8.5 is the version of the Stripe plugin, not of WooCommerce. WooCommerce itself is on 11.0.0. The two sit close enough together to check the wrong one.
What was fixed
The diff between 10.8.4 and 10.8.5 is public. It changes two files of plugin code and adds roughly 1,170 lines of new webhook tests, which is a reasonable indicator of how seriously the team took it. There are two distinct fixes, both in the webhook handler.
1. An unauthenticated request was acted on before its signature was checked
Stripe tells your store what happened to a payment by sending a webhook to a public URL on your site. That endpoint has to accept requests from anyone, because Stripe doesn't log in. The protection is a signature: the plugin verifies the request genuinely came from Stripe before trusting a word of it.
In 10.8.4, one piece of the incoming request was read and written to the WordPress database before that signature check ran. The order of operations was wrong. That meant an unauthenticated request, from anyone at all, reached a database write with a value the sender controlled, and with no check on what type of value it was.
10.8.5 fixes both halves. The write now happens after the signature has been verified, and the value is validated as a plain integer before it's stored, so nothing else can be smuggled through.
We're not publishing a reproduction. The patch is public, but most stores are still on the old version, and the useful thing to say is simply that this is worth doing today.
2. Orders can no longer complete when the amount doesn't match
The second fix compares what Stripe actually settled against what the WordPress order says it should be. If the amount or the currency doesn't match, the order is no longer marked as paid. It goes on-hold with a note explaining the mismatch, so a human can look at it.
This is the same class of problem as the Adaptive Pricing payment validation issue WooCommerce patched in 10.8.4, where the amount processed by Stripe could differ from the order total. 10.8.5 closes it off at the webhook layer as well.
Worth knowing if you're on the receiving end of this: after updating, a mismatched order will sit in on-hold rather than quietly completing. That's the fix working, not a bug. It's better to review a held order than to ship goods against a payment that never fully landed.
What 10.8.5 needs to run
Check this before you update, because 10.8.5 also raised its WooCommerce requirement, and that pulls the WordPress floor up with it.
| Requirement | Stripe plugin 10.8.4 | Stripe plugin 10.8.5 |
|---|---|---|
| WooCommerce | 10.6 or later | 10.8 or later |
| WordPress | 6.8 or later | 6.9 or later |
That WordPress figure is worth explaining, because the plugin itself declares 6.8. WooCommerce 10.8 is the version that needs WordPress 6.9, so once the plugin requires WooCommerce 10.8, 6.9 becomes the real floor whatever the plugin's own header says.
The WooCommerce jump is not something the security fix needed. The fix touches only the plugin's own webhook classes and order methods that have been in WooCommerce for years. The requirement moved because WooCommerce 11.0 landed the day before, and the plugin supports the current WooCommerce release plus the two before it. The two changes simply shipped together.
It still matters, because the check is hard rather than advisory. On WooCommerce below 10.8, the plugin stops before it loads and shows an admin notice reading "Stripe requires WooCommerce 10.8 or greater to be installed and active." Nothing registers, so customers cannot pay with Stripe at all.
So if you're on WooCommerce 10.6 or 10.7, update WooCommerce first, then update the plugin. Going straight for the security patch takes your Stripe checkout down. The plugin already names WooCommerce 10.9 as its next minimum, so this will come round again.
What to do
- Check your version. In WP Admin, go to Plugins and find WooCommerce Stripe Gateway, which WordPress.org lists as "WooCommerce Stripe Payment Gateway" and WooCommerce's own advisories call "Stripe for Woo". They are all the same plugin. Below 10.8.5 means you need to update.
- Check WooCommerce as well. If WooCommerce is below 10.8, update WooCommerce first, or the Stripe plugin will not load at all.
- Update. Take a backup first, as you would with any plugin update on a live store.
- If the update isn't showing yet, that's expected for the first six hours after any release. WordPress.org now holds new plugin versions briefly before serving them to sites, and during that window the update genuinely isn't offered, however many times you refresh. After six hours, use "Check again" on the Updates screen to skip WordPress's own update cache. If you can't wait, download the ZIP from the plugin's WordPress.org page and install it under Plugins, then Add New Plugin, then Upload Plugin.
- Check your staging and development copies too. A forgotten, publicly reachable staging site running the old version carries the same exposure as the live one.
- Watch your on-hold orders for a few days after updating, in case fix two starts catching something.
While you're in there, check Subscriptions
Easy to miss in the same day's noise: WooCommerce also published a security update for WooCommerce Subscriptions 9.1.0. That one has a public advisory, and it's blunt about the impact. An unauthorised user could assume control of the site.
WooCommerce says it has no evidence any store was compromised. If you run Subscriptions, get to 9.1.0 or later, and check every production and staging site.
If you'd rather not think about this
Watching payment plugin security releases and getting patches onto live stores before they become someone else's problem is the job we do. Our team is reachable 24/7, with a one hour support SLA or your money back.
If you're not sure whether your sites are exposed, talk to us and we'll check with you.