Paymob for WooCommerce CVE-2026-56025

Exploitation requires that the target WordPress site has the Paymob for WooCommerce plugin installed and active at version 4.1.2 or earlier, with the vulnerable network-reachable handler (callback/AJAX/REST action) exposed - which is the plugin's default operating state since these endpoints exist to process payments. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed: remote unauthenticated exploitation against default configurations of a WooCommerce store running Paymob for WooCommerce <= 4.1.2. The limiting factors are narrow: the impact is integrity-only (C:N/A:N), so the attacker cannot directly exfiltrate data or cause an outage through this flaw, and the store must actually have this specific plugin deployed and active. The exact protected action invoked is not specified in the available data.

The signals are partially complete. CVSS 7.5 with AV:N/AC:L/PR:N/UI:N marks this as trivially reachable - network attack vector, low complexity, no privileges, no user interaction - which is the high-risk portion of the score. However, impact is narrowed to integrity only (C:N/I:H/A:N), so this is not full compromise: an attacker can tamper with data but cannot directly read confidential information or take the site offline through this flaw alone. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - it is currently a theoretical-but-easily-reachable bug. The realistic priority is moderate-to-high for stores running this plugin precisely because exploitation requires no authentication, but the integrity-only scope and absence of confirmed exploitation temper it below a 'drop everything' emergency. Note: the exact protected action and downstream business impact (e.g., marking unpaid orders as paid) are not detailed in the available data and should be confirmed against the Patchstack advisory.

An attacker enumerates a WooCommerce store using the Paymob plugin and sends a crafted HTTP request directly to the plugin's unauthenticated callback or AJAX action that lacks an authorization check. Because no login, token, or user interaction is required (AV:N/PR:N/UI:N/AC:L), the request manipulates protected state - for example altering an order or payment record - to the attacker's benefit. No public POC is referenced at this time, but the low-complexity unauthenticated nature makes weaponization straightforward once the endpoint is identified.