4.7
Medium
CVE-2026-87981 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX…
Description
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Paymob for WooCommerce 4.1 | earliest → < 4.1.14 | 4.1.14 |
Other CVEs of Paymob for WooCommerce
The 4 CVEs of Paymob for WooCommerce →
CVE-2026-87978
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its…
5.3
Medium
CVE-2026-87979
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch…
5.3
Medium
CVE-2026-15205
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier…
8.6
High