Security
Loading…

CVE-2026-87978

MEDIUMCVSS 5.3
View on NVD← Back to search
Description

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.

Timeline
Published:September 23rd, 2026 11:17 AM
Last modified:September 23rd, 2026 6:13 PM
CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)
CWE-345
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute