What is GHSA-vpgv-m5mc-mgc7?

GHSA-vpgv-m5mc-mgc7 is a security advisory published by GitHub Security Advisories with Medium severity. The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature...

Which CVE IDs does GHSA-vpgv-m5mc-mgc7 cover?

GHSA-vpgv-m5mc-mgc7 covers the following CVE IDs: CVE-2026-87978. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vpgv-m5mc-mgc7?

GHSA-vpgv-m5mc-mgc7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-vpgv-m5mc-mgc7MediumCVSS 5.3

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature...

Vendor

GitHub Security Advisories

Published

September 23, 2026

Last Modified

September 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-87978 →

📋 Description

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87978
https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7
https://github.com/advisories/GHSA-vpgv-m5mc-mgc7