CVE-2026-87979
Received Received - Intake

Unauthenticated Card Token Write in Paymob for WooCommerce

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-87979
EUVD
EUVD-2026-85049

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paymob paymob_for_woocommerce to 4.1.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Paymob for WooCommerce WordPress plugin before version 4.1.14. It allows unauthenticated attackers to write a saved card token to any user's account via a webhook due to missing request signature verification on the card-token branch. Attackers can also enumerate registered accounts.

Detection Guidance

Check if your Paymob for WooCommerce plugin version is below 4.1.14. Monitor webhook logs for unauthorized card-token writes or account enumeration attempts. Review network traffic for suspicious requests to the card-token branch of the payment webhook.

Impact Analysis

Unauthenticated attackers could add saved payment tokens to any user account, potentially leading to unauthorized transactions. They could also identify valid registered accounts for further attacks.

Mitigation Strategies

Update the Paymob for WooCommerce plugin to version 4.1.14 or later immediately. Disable the card-token webhook branch if not required. Implement request signature verification for all webhook branches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart