PT-2026-97275

CVE-2026-87978

Published

2026-09-21

Updated

2026-09-23

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce versions prior to 4.1.14

Description An issue exists where the plugin fails to verify the request signature on a specific branch of its payment webhook. This lack of server-side payment verification allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without completing the actual payment process.

Recommendations Update to version 4.1.14 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Charles Vosburgh

Vendors

Affected products

Weakness enumeration

CWE-345: Insufficient Verification of Data Authenticity

Related identifiers