EUVD-2026-39688
GHSA-ph7r-rmf7-q23w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network-reachable handler with no authorization check (PR:N/AV:N/AC:L) that mutates state, giving high integrity impact but no confidentiality or availability effect.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
Articles & Coverage 1
AnalysisAI
Broken access control in the Paymob for WooCommerce WordPress plugin (versions <= 4.1.2) allows remote unauthenticated attackers to invoke a protected function or action that lacks an authorization check, producing a high integrity impact (CVSS 7.5, CVSS:3.1/.../I:H). The flaw maps to CWE-862 (Missing Authorization), meaning a function reachable over the network performs no capability or ownership validation before acting. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
Paymob for WooCommerce is a payment-gateway integration plugin that connects WordPress/WooCommerce stores to the Paymob payment processor, typically registering REST endpoints, AJAX handlers, or webhook/callback routes to handle order and payment state. The root cause is CWE-862 (Missing Authorization): a sensitive operation is exposed without verifying that the caller holds the required capability or is the legitimate owner of the affected resource. Because the CVSS vector is AV:N/PR:N/UI:N, the vulnerable handler is reachable directly over HTTP with no session, suggesting an unauthenticated callback or AJAX action (consistent with the 'Authentication Bypass' tag) that mutates state - the integrity-only impact (C:N/I:H/A:N) indicates an attacker can alter data, most plausibly order or payment status, without reading sensitive data or causing downtime.
RemediationAI
Upgrade the Paymob for WooCommerce plugin to a release newer than 4.1.2 as soon as the vendor publishes one; the input data does not contain a confirmed fixed version, so verify the patched release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/paymob-for-woocommerce/vulnerability/wordpress-paymob-for-woocommerce-plugin-4-1-2-broken-access-control-vulnerability) before deploying. If a patch is not yet available for your environment, compensating controls include restricting access to the plugin's callback/AJAX/REST endpoints at the web-server or WAF layer (allowlisting only Paymob's published payment-gateway source IP ranges for the payment callback URL), which preserves legitimate payment notifications while blocking arbitrary callers but requires maintaining Paymob's IP list; reconciling order/payment status against the Paymob merchant dashboard to detect tampering; and, as a last resort, deactivating the plugin and disabling Paymob checkout, which stops the exposure but also disables payment processing for customers. No vendor-released patch version is identified in the provided data, so absence of a fix here reflects missing input rather than confirmation that none exists.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today