Executive brief
The Paymob for WooCommerce plugin processes payments through webhooks that notify WordPress when a transaction is complete. A flaw in the payment webhook allows attackers to forge fake payment notifications without authentication, tricking the store into marking orders as paid even when no payment occurred. This could enable unauthorized inventory depletion, financial loss, or theft of digital goods.
Technical details
The plugin fails to verify cryptographic request signatures on one code path of its payment webhook callback, allowing unauthenticated attackers to craft malicious webhook POST requests that trigger order completion. An attacker can call the webhook endpoint directly with arbitrary order identifiers and payment status without requiring valid payment processor credentials or signatures. No user interaction or authentication is required beyond network access to the WordPress site.
Affected products
- Paymob Paymob for WooCommerce before 4.1.14
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: version 4.1.14 released