CVE-2026-87979

Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.

Affected

Paymob for WooCommerce

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 9th percentile

Published

2026-09-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/550a465c-4856-45bb-b609-0eaf1f2be660/

References

• CVE Record
• NVD entry