# CVE-2026-87978: Paymob for WooCommerce payment bypass in webhook verification

Source: https://junglewise.ai/threats/cve-2026-87978-the-paymob-for-woocommerce-wordpress-plugin-before-4-1-14-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87978 · Severity: medium · CVSS 5.3 · Published 2026-09-23

The Paymob for WooCommerce plugin processes payments through webhooks that notify WordPress when a transaction is complete. A flaw in the payment webhook allows attackers to forge fake payment notifications without authentication, tricking the store into marking orders as paid even when no payment occurred. This could enable unauthorized inventory depletion, financial loss, or theft of digital goods.

Technologies: [Paymob for WooCommerce](https://junglewise.ai/threats/technologies/paymob-for-woocommerce). Vendors: [Paymob](https://junglewise.ai/threats/vendors/paymob).

## Quick answers

**Is CVE-2026-87978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87978 being exploited in the wild.

**How severe is CVE-2026-87978?** Medium severity, with a CVSS score of 5.3, published 23 September 2026.

**Which products and versions are affected?** Paymob for WooCommerce before 4.1.14.

**Is there a fix for CVE-2026-87978?** A patch was published on 2026-09-23: version 4.1.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87978 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-87978?** Check whether you run Paymob for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to verify cryptographic request signatures on one code path of its payment webhook callback, allowing unauthenticated attackers to craft malicious webhook POST requests that trigger order completion. An attacker can call the webhook endpoint directly with arbitrary order identifiers and payment status without requiring valid payment processor credentials or signatures. No user interaction or authentication is required beyond network access to the WordPress site.

## Affected products

- Paymob Paymob for WooCommerce before 4.1.14

## Timeline

- 2026-09-21: disclosed
- 2026-09-23: patched: version 4.1.14 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/](https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/)

## Related threats

- [Paymob for WooCommerce AJAX actions missing capability check](https://junglewise.ai/threats/cve-2026-87981-the-paymob-for-woocommerce-wordpress-plugin-before-4-1-14-does)
- [Paymob for WooCommerce webhook signature verification bypass](https://junglewise.ai/threats/cve-2026-87979-the-paymob-for-woocommerce-wordpress-plugin-before-4-1-14-does)
- [Paymob for WooCommerce cross-site scripting in payment forms](https://junglewise.ai/threats/cve-2026-66611-paymob-for-woocommerce-cross-site-scripting-in-payment-forms)
- [Paymob for WooCommerce SQL injection in payment callback](https://junglewise.ai/threats/cve-2026-15205-paymob-for-woocommerce-sql-injection-in-payment-callback)
- [Paymob Paymob for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-56025-paymob-paymob-for-woocommerce-broken-access-control)