CVE-2026-121970 in Pay with Vipps and MobilePay Plugin
Summary
by MITRE • 11/04/2026
Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in the Pay with Vipps and MobilePay for WooCommerce plugin, specifically versions prior to 6.4.1, represents a critical failure in cryptographic integrity verification within its recurring-payment webhook handler. This flaw stems from improper handling of secret keys used for validating incoming HTTP requests from payment gateways. In secure web application architectures, it is standard practice to verify the authenticity and integrity of external callbacks by comparing an HMAC signature provided in the request header against a locally stored shared secret. The plugin's implementation deviates significantly from these security best practices when no local webhook secret has been configured or saved by the administrator. Instead of rejecting such requests outright as unauthenticated, the code proceeds to compute an HMAC using an empty string as the key. This fundamental logic error allows any external actor to generate a valid signature for arbitrary data without possessing the actual shared secret, effectively bypassing authentication mechanisms designed to prevent unauthorized state changes.
From a technical perspective, the vulnerability is exacerbated by two distinct coding errors that compound the risk. First, the application fails to return or reject requests when the local webhook secret is empty, treating this absence as a valid configuration rather than an error condition requiring secure defaults or explicit rejection. Second, even if a key were present, the code utilizes PHP's loose equality operator (==) for comparing cryptographic hashes instead of the timing-safe function hash_equals(). While the primary exploit vector described relies on the empty secret scenario, the use of == introduces additional risks related to type juggling and potential collision attacks in other contexts. The combination of these flaws means that an unauthenticated attacker can craft a malicious webhook payload with any desired content, including a signature calculated using an empty key, which will be accepted by the vulnerable system as legitimate because it matches the hash computed internally against the same empty string.
The operational impact of this vulnerability is severe for e-commerce businesses relying on WooCommerce and its subscription management features via Vipps or MobilePay integrations. An attacker can exploit this flaw to forge a recurring.agreement-stopped.v1 event, which signals that a customer's payment agreement has been terminated. By supplying a known agreementId alongside the forged empty-key signature, an adversary can force the cancellation of active subscriptions for any user in the system. This results in direct financial loss through lost revenue from canceled services or products, as well as significant reputational damage and potential legal liabilities if customers are charged after their subscriptions have been fraudulently terminated by attackers manipulating the backend logic. The ability to act without authentication makes this a high-severity issue that can be exploited remotely with minimal effort.
To mitigate this vulnerability, immediate action is required for all administrators using versions of the plugin prior to 6.4.1. The primary remediation step is to upgrade the Pay with Vipps and MobilePay for WooCommerce plugin to version 6.4.1 or later, where these cryptographic verification flaws have been addressed by enforcing strict validation checks and implementing timing-safe comparisons. In environments where upgrading is not immediately feasible, administrators should ensure that a strong, randomly generated webhook secret is configured within the plugin settings rather than leaving it blank. This ensures that the HMAC computation uses a non-empty key, although relying on this workaround does not fully address the underlying code quality issues regarding loose comparison operators. Furthermore, implementing network-level controls such as IP allow-listing for payment gateway webhooks can provide an additional layer of defense by restricting which sources are permitted to send webhook events to the WooCommerce instance.
This vulnerability aligns with CWE-347 Improper Verification of Cryptographic Signature, as it involves a failure to properly validate that data has not been tampered with and originates from a trusted source. Additionally, the exploitation technique maps to MITRE ATT&CK T1568.002 Dynamic Resolution: Cloud Infrastructure, specifically in the context of abusing legitimate service integrations for unauthorized actions, though more broadly it reflects common web application flaws found under CWE-287 Improper Authentication and CWE-349 Acceptance of Validated Data as Untrusted Input when processing webhook payloads. The incident underscores the necessity of rigorous input validation and secure cryptographic implementation in all components that handle sensitive state-changing events from external services, particularly those involving financial transactions and subscription management systems.