CVE-2026-56025
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Paymob for WooCommerce plugin version 4.1.2 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can exploit this flaw to gain unauthorized access to plugin functions.
Risk Assessment
The risk includes unauthorized access to sensitive plugin functions, potentially leading to data integrity breaches or unauthorized actions within the WooCommerce system.
Recommendation
It is recommended to immediately update the Paymob for WooCommerce plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Paymob for WooCommerce <= 4.1.2
See all- CVE-2026-66611High
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce versions up to 4.1.10. An attacker can inject malicious script without authentication.
- CVE-2026-87978Medium
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
- CVE-2026-87981Medium
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration. Users with contributor-level access can delete, wipe, or modify that configuration, including the stored payment credentials.
- CVE-2026-87979Medium
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook. Unauthenticated attackers can write a card-token record to any user's account and enumerate registered accounts.
Original NVD description (English source)
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS