CVE-2026-87978

Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.

Affected

Paymob for WooCommerce

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.11% chance of exploitation in the next 30 days, 1st percentile

Published

2026-09-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/

References

• CVE Record
• NVD entry