Description

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-23T06:17:04.657Z",
  "pubdate": "2026-09-23T06:17:04.657Z",
  "executiveSummary": "The Paymob for WooCommerce WordPress plugin, in versions prior to 4.1.14, contains a critical authentication bypass vulnerability within its webhook processing mechanism.\nSpecifically, the 'card-token' branch of the payment webhook fails to perform necessary cryptographic signature verification, which is intended to validate the authenticity and integrity of incoming requests.\nThis flaw allows unauthenticated remote attackers to inject arbitrary card-token records directly into the database of any registered user account.\nBeyond data injection, the vulnerability facilitates the enumeration of registered user accounts by observing response behaviors during malicious request submission.\nThe risk is severe as it enables unauthorized modification of user-associated payment data, potentially leading to unauthorized transactions or account takeover scenarios depending on downstream platform trust.\nExploitation requires no authentication and relies on the public accessibility of the webhook endpoint.",
  "technicalDetails": "The vulnerability originates from a deficiency in the input validation logic within the webhook handler for Paymob payment notifications. In the affected versions, the plugin fails to implement or correctly invoke the signature verification process for requests routed to the 'card-token' branch.\nNormally, webhooks provided by payment gateways include a HMAC or similar digital signature in the request headers. The receiving server is expected to calculate the hash of the request body using a shared secret and compare it against the provided header to ensure the request originated from the legitimate provider.\nBecause the 'card-token' branch lacks this check, the application implicitly trusts any POST request reaching the endpoint. An attacker can craft a malicious HTTP request that mimics the structure of a valid Paymob webhook payload.\nThe attack flow proceeds as follows: 1) The attacker identifies the endpoint associated with Paymob webhooks in WooCommerce. 2) The attacker crafts a request containing a fraudulent card-token payload. 3) The attacker submits this request to the server without a valid signature. 4) The plugin processes the request and executes the logic intended for legitimate payment token association.\nBy manipulating parameters within the payload, an attacker can target specific user accounts. If the application logic utilizes user IDs or identifiers provided in the unverified request to associate a token, the attacker can systematically inject malicious tokens into victim accounts.\nFurthermore, by analyzing the server's response or error logs while iterating through potential user identifiers in the payload, an attacker can confirm the existence of registered accounts, effectively performing user enumeration.\nThis vulnerability resides in the core webhook processing component of the plugin. Because this component is exposed via the web server to the public internet, no privileges are required to exploit the flaw. The impact is significant, as it violates the integrity of the user-token association model, allowing for unauthorized storage of payment tokens that could be exploited in future transaction flows if the plugin or the integrated gateway fails to perform subsequent verification on those tokens."
}