Security Alert Summary
The Paymob for WooCommerce plugin before 4.1.14 contains a vulnerability in its payment webhook handling that fails to verify the request signature on one branch of processing. An unauthenticated attacker can exploit this to mark arbitrary WooCommerce orders as paid without providing any payment.
CVE Details
- CVE ID:
CVE-2026-87978 - Affected component: Paymob for WooCommerce (payment webhook)
- Affected versions: Versions before 4.1.14
- Published: September 23, 2026 at 11:17:15 AM UTC
- Last modified: September 23, 2026 at 11:17:15 AM UTC
- CVSS v3.1: Base score 5.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User Interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Integrity: Low; Confidentiality: None; Availability: None
- Weakness: CWE-345 (Insufficient Verification of Data Authenticity)
Technical Details
The plugin fails to verify the request signature on one branch of its payment webhook handling. Because the webhook branch does not enforce signature verification, an attacker can submit forged webhook requests that the plugin accepts as legitimate. The verified outcome of those webhook requests is that WooCommerce orders are marked as paid without an actual payment being processed.
The issue exists specifically in the payment webhook path where the signature check is omitted on a processing branch. The description does not name functions or endpoint URLs; it identifies the affected component generally as the payment webhook. The vulnerability results in an integrity impact limited to order state: orders can be transitioned to a paid status without payment.
How This Could Impact Your Website
In a practical scenario, a site owner, internal staff member (such as someone in operations or fulfillment), and an external contractor (for example, a developer or payment integrator) may all be involved in order processing. If an attacker marks orders as paid, the operations team could fulfill or ship goods for orders that never completed payment, resulting in financial loss and operational confusion.
Although the CVSS data indicates no direct confidentiality impact, this kind of order manipulation can create secondary risks. For example, altered order records or follow-up communications could increase the chance of targeted phishing or social engineering against staff or customers. It does not, by itself, disclose user passwords or other sensitive credentials.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and other roles that can affect order or payment workflows.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and order logs for unusual behavior, such as orders marked paid without a corresponding payment transaction.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
