5.3
Medium
CVE-2026-87978 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its…
Description
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Paymob for WooCommerce 4.1 | earliest → < 4.1.14 | 4.1.14 |
Other CVEs of Paymob for WooCommerce
The 4 CVEs of Paymob for WooCommerce →
CVE-2026-87981
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX…
4.7
Medium
CVE-2026-87979
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch…
5.3
Medium
CVE-2026-15205
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier…
8.6
High