The vulnerability is present in Paymob for WooCommerce WordPress plug‑in versions prior to 4.1.14. One branch of the payment webhook fails to verify the request signature, allowing an attacker to send a forged subscription transaction callback. The attacker can set any WooCommerce order status to paid without completing a legitimate payment, creating a fraud path that can lead to revenue loss, unauthorized fulfillment of goods or services, and exploitation of the e‑commerce process. This weakness aligns with CWE‑345, an insecure or insufficient validation of cryptographic authority.

Systems running the Paymob for WooCommerce plug‑in at or below version 4.1.13 are affected. No other vendors or product versions are listed. Wordpress sites that have not updated the plug‑in remain at risk.

The CVSS score of 5.3 indicates a moderate severity level. No EPSS score is available, so the exploitation probability is unknown, but the flaw permits unauthenticated exploitation with a low technical barrier. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the insecure webhook simply by posting a crafted callback payload to the plugin’s endpoint; no authentication is required and the gateway does not verify the signature. Consequently, the flaw is relatively easy to exploit for those who know the webhook URL and can forge a message.