CVE-2026-87978 — Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback

CVE-2026-87978

Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback PUBLISHED

Description (CNA)

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.

Affected (CNA)

Vendor / product	Versions
Unknown / Paymob for WooCommerce	affected 0 before 4.1.14

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.