EUVD-2026-85194
GHSA-vpgv-m5mc-mgc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WooCommerce webhook endpoint over network
-
DeliveryPlace order and note its ID
-
ExploitSend forged webhook to unverified branch
-
ExecutionOrder marked paid without payment
-
ImpactObtain goods/services fraudulently
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Requires the Paymob for WooCommerce plugin at a version before 4.1.14 installed and active on a WooCommerce store, with its payment webhook endpoint network-reachable (default for a live store accepting Paymob payments). Exploitation targets the specific webhook branch that fails to verify the request signature; no authentication, no credentials, and no user interaction are required. The main limiting factor is simply that the store must run the vulnerable version and process orders via this plugin; there is no non-default configuration needed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3, MEDIUM) is internally consistent with the description: a remote, unauthenticated attacker over the network with low complexity abuses a webhook branch that skips signature verification. The impact is integrity-only and rated Low (I:L, C:N/A:N), which is arguably conservative given the real business consequence - an attacker can mark arbitrary WooCommerce orders as 'paid' and obtain goods/services without payment, i.e. direct financial fraud against the merchant. A publicly available exploit exists (referenced by WPScan), so this is 'publicly available exploit code exists', but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active, widespread exploitation at this time. Net: this is a genuinely actionable priority for any merchant running the affected plugin because it is trivially reachable and directly monetizable, even though its raw CVSS is only MEDIUM. Note a metadata conflict: the 'Information Disclosure' tag contradicts the vector (C:N, I:L) - this is a business-logic/integrity flaw, not a disclosure issue. |
| Exploit ScenarioDerived | An attacker identifies a store running Paymob for WooCommerce below 4.1.14 and places an order, leaving it unpaid. They then send a crafted request directly to the plugin's payment webhook endpoint, hitting the branch that omits signature verification, causing WooCommerce to mark the order as paid. Because public exploit details are available via WPScan and no authentication or user interaction is required, the attack is low-effort and repeatable for order/payment fraud. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated attackers can forge payment webhook requests to mark arbitrary WooCommerce orders as paid without any money changing hands in the Paymob for WooCommerce WordPress plugin before version 4.1.14. The weakness is confined to one branch of the plugin's payment webhook handling that omits request-signature verification, so no credentials and no user interaction are required - only that the store runs the vulnerable plugin with its webhook endpoint network-reachable. Publicly available exploit code exists, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3 MEDIUM) reflects a remote, unauthenticated business-logic integrity impact rather than data theft or code execution.
RemediationAI
Vendor-released patch: upgrade the Paymob for WooCommerce plugin to version 4.1.14 or later, which is the first version that verifies the request signature on the affected webhook branch; apply the update through the WordPress plugin manager or by deploying the tagged release, and confirm the plugin version afterwards via the WordPress admin or WP-CLI. See the WPScan advisory at https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/ for the authoritative record. If the update cannot be applied immediately, compensating controls are: restrict the Paymob webhook URL at the reverse proxy/WAF to Paymob's published source IP ranges or require a secret query parameter, accepting the trade-off that IP changes or provider reconfiguration will silently break legitimate payment confirmations; or temporarily disable the Paymob gateway and route customers to an alternative payment method, accepting loss of that payment option and disruption to checkout. In all cases, review recent orders for unexpected 'paid'/'processing' status transitions that do not correspond to settled Paymob transactions, reconcile them against the Paymob dashboard, and reverse or refund fraudulent fulfilments, since exploitation produces no crash, log signature, or other loud indicator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Payment gateway plugins for WooCommerce, such as Paymob for WooCommerce, receive server-to-server callbacks from the payment provider's webhook endpoint and use them to transition an order from pending to processing/completed. Because those callbacks are HTTP POSTs reachable from the internet, authenticity is normally established by validating an HMAC/signature (or equivalent shared-secret token) supplied by the provider. In this plugin, that validation is applied on most code paths but is skipped on a specific webhook branch, so a crafted request that reaches that branch is treated as a legitimate payment confirmation. The root cause class is improper verification of a cryptographic signature / insufficient verification of data authenticity on a security-relevant state change (no CWE identifier was supplied in the source data for this record). The impact is limited to integrity of order state (CVSS I:L, S:U) - there is no confidentiality or availability impact, so the practical consequence is fraudulent fulfilment/accounting rather than system compromise. Note that the NVD-style CPE entry (cpe:2.3:a:unknown:paymob_for_woocommerce:*:*:*:*:*:*:*:*) uses an unresolved "unknown" vendor namespace, meaning affected-version tracking for this plugin relies on the vendor/WPScan advisory rather than standardized CPE matching; the accompanying 'Information Disclosure' tag does not match the assessed integrity-only impact and appears to be a generic taxonomy artifact.
Know when Paymob For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated webhook with no signature check (AV:N/AC:L/PR:N/UI:N); integrity-only impact from falsifying order-paid state (I:L), no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB