5.3
Medium
CVE-2026-87979 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch…
Description
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Paymob for WooCommerce 4.1 | earliest → < 4.1.14 | 4.1.14 |
Other CVEs of Paymob for WooCommerce
The 4 CVEs of Paymob for WooCommerce →
CVE-2026-87978
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its…
5.3
Medium
CVE-2026-87981
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX…
4.7
Medium
CVE-2026-15205
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier…
8.6
High