The vulnerability lies in an improper verification of cryptographic signatures on recurring‑payment webhooks. When the plugin has no locally configured webhook secret, the signature check falls back to an HMAC keyed with an empty string and uses a loose equality comparison rather than a secure timing‑safe comparison. This allows an attacker to craft a recurring.agreement‑stopped.v1 event with a known agreementId and an empty‑key signature, effectively canceling a victim’s active WooCommerce subscription without authentication.

The affected product is the "Pay with Vipps and MobilePay for WooCommerce" plugin from wphostingdev. Versions earlier than 6.4.1 are vulnerable. Administrators using WooCommerce with this plugin should verify the plugin version and configuration of the webhook secret.

The CVSS score of 6.3 indicates a medium severity impact. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending forged webhook requests to the WooCommerce site, provided the plugin does not have a non‑empty webhook secret. Because the attack requires only crafting the request, it can be performed by unauthenticated actors who know the subscription’s agreementId. The exploit directly compromises the integrity of subscription billing, allowing unwanted cancellations and potential financial loss for the site owner.