CVE-2026-121970Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.

6.3 MEDIUMEPSS 0.18%Not in KEVNVD: Received

Last updated: 2026-11-04 19:17 UTC

OverviewCVSS details

6.3MEDIUMCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Received
Published: Nov 4, 2026
Assigner: VulnCheck

Affected

Pay with Vipps and MobilePay for WooCommerce (wphostingdev)

Versions: 5.0.0 before 6.4.1
Fixed in: 6.4.1

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.18%chance of exploitation in 30 days

Higher than 8.39% of CVEs

CVSS 4.0 · VulnCheck (CNA)

6.3Medium

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality impact: None
Integrity impact: Low
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulnCheck (CNA)

3.7Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: Low
Availability impact: None

NVD status: Received

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
6.3	MEDIUM	4.0VulnCheck (CNA)	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3.7	LOW	3.1VulnCheck (CNA)	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CVE ID: CVE-2026-121970
Status: Received
Assigner (CNA): VulnCheck
Published: Nov 4, 2026
Last modified: 2026-11-04 19:17 UTC
Weaknesses: CWE-347 · Improper Verification of Cryptographic Signature

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:55 UTC.