Read the docs
TI-2026-85061 Aliases CVE-2026-121970GHSA-x965-w74v-3qc3

Webhook signature forgery in Vipps and MobilePay for WooCommerce

Priority LOW 27CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) from 5.0.0 before 6.4.1 is affected. The recurring-payment webhook handler does not stop when the webhook secret is empty and compares signatures with a loose comparison instead of a constant-time check, which is improper cryptographic signature verification (CWE-347). An unauthenticated remote attacker can forge webhook requests and cancel a victim's active WooCommerce subscription.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00187 8th percentileScored 2026-11-07
Fix Fixed Pay with Vipps and MobilePay for WooCommerce (wphostingdev): 6.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wphostingdevPay with Vipps and MobilePay for WooCommerce5.0.0 to before 6.4.16.4.1Patch availableCNA
  • Pay with Vipps and MobilePay for WooCommerce Vendorwphostingdev Affected 5.0.0 to before 6.4.1 Fixed in 6.4.1 Patch available CNA

Remediation

Update Pay with Vipps and MobilePay for WooCommerce to 6.4.1, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Pay with Vipps and MobilePay for WooCommerce (wphostingdev) Fixed in 6.4.1

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121970
  2. 2026-11-04 Alias added: GHSA-x965-w74v-3qc3
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → LOW

References

Patch 1

Other 2

  • TI-2024-10930 Login with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences