Description

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-23T06:17:04.760Z",
  "pubdate": "2026-09-23T06:17:04.760Z",
  "executiveSummary": "The Paymob for WooCommerce WordPress plugin contains a critical broken access control vulnerability affecting administrative AJAX handlers. The flaw stems from the omission of capability checks within the plugin's configuration management functions. This oversight permits unprivileged authenticated users, specifically those with the Contributor role, to interact with sensitive administrative endpoints intended strictly for site administrators.\nBy invoking these AJAX actions, an attacker can modify, overwrite, or delete the payment gateway's configuration, including critical API credentials and security keys. The exploitation of this vulnerability poses a severe risk to the integrity of the payment processing pipeline, potentially leading to unauthorized redirection of funds, data exfiltration, or complete denial of service for the payment gateway. Because this is an authenticated vulnerability, exploitation requires a valid user account with at least Contributor-level access to the WordPress environment. This vulnerability highlights the necessity of strictly enforcing WordPress capability checks such as 'manage_options' or 'manage_woocommerce' on all administrative or sensitive backend functions.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of WordPress admin-ajax handlers within the Paymob for WooCommerce plugin. In WordPress, plugins frequently use the 'wp_ajax_' hook to perform background administrative tasks. A secure implementation of these hooks must include a verification step to ensure the requester possesses sufficient permissions, typically performed using the 'current_user_can()' function against a specific capability.\nIn versions prior to 4.1.14, the Paymob for WooCommerce plugin registers multiple AJAX actions responsible for handling payment-gateway settings without performing any validation of the user's role or capabilities. When these AJAX requests are dispatched to 'wp-admin/admin-ajax.php', the plugin directly executes the associated callback functions without verifying if the caller is an administrator.\nAn attacker with Contributor-level access can construct a malicious HTTP request targeting these vulnerable AJAX hooks. By manipulating the 'action' parameter and providing valid input for the plugin’s configuration fields, the attacker can force the plugin to update its settings. This includes the ability to modify the 'merchant_id', 'iframe_id', 'api_key', and other gateway-specific parameters. Because these endpoints lack the standard 'check_ajax_referer' nonce verification, they are also susceptible to Cross-Site Request Forgery (CSRF) if the attacker can induce an administrator to trigger the request; however, the primary impact is the unauthorized configuration manipulation by a low-privileged account.\nThe attack flow proceeds as follows: 1) The authenticated Contributor identifies the specific 'wp_ajax_' actions used by the plugin for settings management; 2) The attacker crafts a request, such as a POST request to 'admin-ajax.php' with the appropriate action name and desired modified configuration parameters; 3) The plugin processes the request as if it were a legitimate administrative update; 4) The payment configuration is updated or wiped based on the attacker's input. The post-exploitation impact allows an attacker to misdirect transactions to unauthorized accounts or invalidate the payment gateway entirely, resulting in significant financial and operational damage to the WordPress merchant site."
}