EUVD-2026-85050
GHSA-pgxh-7vg6-g5g2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Contributor is a low-privilege role so PR:L not PR:H; tampering with stored payment credentials/config is primarily an integrity impact (I:H), with limited credential exposure (C:L) and config-wipe disruption (A:L).
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
8DescriptionCVE.org
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
AnalysisAI
Authenticated users holding only contributor-level access on WordPress sites running the Paymob for WooCommerce plugin before 4.1.14 can delete, wipe, or modify the plugin's payment-gateway configuration, including stored Paymob payment credentials, because several admin-AJAX handlers omit a capability check (CWE-862 missing authorization). The affected site must have the plugin installed and active, and the attacker must first obtain a low-privilege account - via open registration or a compromised contributor user - after which no administrator interaction and no non-default configuration are required, yielding low confidentiality and availability impact but high integrity impact on the gateway configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with contributor-level access (or higher) on a site running the Paymob for WooCommerce plugin before 4.1.14; the attack targets several admin-AJAX actions that lack a capability check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue best characterized as an authorization (missing capability check) flaw, not the 'Authentication Bypass' the tags claim. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Paymob for WooCommerce to version 4.1.14 or later, which restores the missing capability checks on the affected admin-AJAX handlers; the fix should be validated by confirming the plugin version in the WordPress admin Plugins screen and by ensuring the updated files are deployed from the vendor rather than a cached or stale copy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today