CVE-2026-87978 in Paymob for WooCommerce Plugin
Summary
by MITRE • 09/23/2026
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Paymob for WooCommerce WordPress plugin prior to version 4.1.14 represents a critical failure in authentication and integrity verification mechanisms within the application's webhook handling logic. Webhooks are essential components of modern e-commerce architectures, serving as server-to-server communication channels that allow external payment gateways to notify merchant platforms when transactions have been completed or updated. In this specific implementation, the plugin processes incoming HTTP requests from Paymob to update order statuses in WooCommerce. However, a logical flaw exists wherein one particular branch of the webhook processing code fails to validate the cryptographic signature attached to the request payload. This omission creates a significant security gap that undermines the trust model between the payment processor and the e-commerce platform.
From a technical perspective, this issue is classified as CWE-347: Improper Verification of Cryptographic Signature. The absence of signature verification means that any entity capable of sending an HTTP POST request to the designated webhook endpoint can manipulate the state of orders without possessing valid credentials or cryptographic keys. Attackers do not need to compromise user accounts or exploit server-side code execution flaws; they simply need to construct a malicious payload with arbitrary order identifiers and submit it to the vulnerable endpoint. The application, lacking the necessary checks, accepts this input as legitimate because it does not verify that the request originated from the authorized Paymob service using the expected signing algorithm and secret key.
The operational impact of this vulnerability is severe for merchants relying on WooCommerce and Paymob integration. An unauthenticated attacker can exploit this flaw to mark any order in the system as paid, regardless of whether actual funds were transferred. This leads directly to financial loss through fraud, where goods or services are shipped or delivered based on false confirmation of payment. Beyond immediate monetary theft, such an attack erodes customer trust and complicates inventory management systems that rely on accurate order status data. Furthermore, the ability to arbitrarily alter database records via webhooks can disrupt audit trails and complicate forensic investigations into other potential security incidents within the e-commerce environment.
This vulnerability aligns with MITRE ATT&CK technique T1496: Resource Hijacking or more specifically in this context, it facilitates unauthorized access leading to data manipulation, which falls under tactics related to persistence or impact depending on the attacker's ultimate goal. It is also closely related to CWE-287: Improper Authentication, as the system fails to properly verify the identity of the sender before performing sensitive state changes. The lack of input validation and authentication in webhook handlers is a common pitfall in web application development, often stemming from an assumption that internal network paths or specific URL patterns provide sufficient security without explicit cryptographic verification.
To mitigate this risk, immediate action must be taken by updating the Paymob for WooCommerce plugin to version 4.1.14 or later, where the signature verification logic has been corrected across all code branches handling webhook requests. Administrators should also ensure that their web server configurations restrict access to sensitive endpoints if possible, although cryptographic validation remains the primary defense. For organizations managing multiple instances of this vulnerability, it is advisable to review recent order logs for anomalies such as orders marked paid without corresponding transaction records in the payment gateway's dashboard. Implementing strict input validation and enforcing signature checks on all incoming webhook requests are standard best practices that prevent similar vulnerabilities from being exploited in other integrations or future versions of the software.