Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Paymob for WooCommerce 4.1.14 Clear all filters
TI-2026-60010 CVE-2026-87978 · GHSA-vpgv-m5mc-mgc7

Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback

Priority LOW 29

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid withou…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00163 Published 2026-09-23 Fixed in 4.1.14 CWE-345
TI-2026-60012 CVE-2026-87981 · GHSA-pgxh-7vg6-g5g2

Missing authorization in Paymob for WooCommerce

Priority LOW 21

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to d…

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00288 Published 2026-09-23 Fixed in 4.1.14 CWE-862
TI-2026-60011 CVE-2026-87979 · GHSA-7x4m-8ff6-56c9

Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook

Priority LOW 30

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0033 Published 2026-09-23 Fixed in 4.1.14 CWE-862