CVE-2026-121970: Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery
Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hashequals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
Event History
Frequently Asked Questions
Which installations are exposed to this issue?
Installations running a version before 6.4.1 are exposed when no local webhook secret is stored for the recurring-payment webhook handler. The affected path handles recurring-payment webhook events.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to know a victim's active subscription agreementId and can forge a recurring.agreement-stopped.v1 webhook event using a signature generated with an empty key.
What is the practical impact of successful exploitation?
A successful forged webhook request can cancel a victim's active WooCommerce subscription. The provided impact assessment indicates integrity impact, with no stated confidentiality or availability impact.
What can be done if upgrading is not immediately possible?
Ensure that a local webhook secret is stored so the handler does not verify signatures using an empty secret. Upgrade to version 6.4.1 or later when possible.