Paymob for WooCommerce
by WordPress
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-15205 | Hig | 0.56 | 8.6 | 0.00 | Aug 14, 2026 | The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature.… | ||
| CVE-2026-56025 | Hig | 0.49 | 7.5 | 0.00 | Jun 26, 2026 | Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions. | ||
| CVE-2026-66611 | Hig | 0.46 | 7.1 | 0.00 | Aug 20, 2026 | Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions. | ||
| CVE-2026-87978 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment. | ||
| CVE-2026-87979 | Med | 0.34 | 5.3 | 0.00 | Sep 23, 2026 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts. | ||
| CVE-2026-87981 | Med | 0.31 | 4.7 | 0.00 | Sep 23, 2026 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the… |
- risk 0.56cvss 8.6epss 0.00
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature.…
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
- risk 0.34cvss 5.3epss 0.00
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
- risk 0.34cvss 5.3epss 0.00
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
- risk 0.31cvss 4.7epss 0.00
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the…