Wordpress Alert: Webhook signature validation failures

What it looks like

An integration accepts incoming webhook data without verifying its signature.

Why it matters

A forged notification may trigger order or account actions.

What to check

Check the receiver's signature validation and secret rotation.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WooCommerce webhooks.