CVE-2026-121970
Last modified
CVE-2026-121970 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription..
Description
Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| wphostingdev | Pay with Vipps and MobilePay for WooCommerce | >= 5.0.0, < 6.4.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-121970?
How severe is CVE-2026-121970?
How do I fix CVE-2026-121970?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121965Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 …5.3
- CVE-2026-121966Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends Forwa…8.7
- CVE-2026-121967Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 b…4.9
- CVE-2026-121968Netrek-client-cow through 3.3.3 contains an out-of-bounds re…6.5
- CVE-2026-121969netrek-client-cow through 3.3.3 contains a stack-based buffe…6.5
- CVE-2026-12197A security flaw has been discovered in Ruijie EG105G-P 2.340…7.3
- CVE-2026-121971The component ScopingHttpClient in Symfony HttpClient merges…8.2
- CVE-2026-12198A weakness has been identified in Microweber up to 2.0.20. T…7.3
- CVE-2026-12199A vulnerability in `nltk.app.wordnet_app` up to version 3.9.…7.5
- CVE-2026-121993wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains …4.3
- CVE-2026-121994A stack buffer overflow in the GDB client's remote protocol …8.8
- CVE-2026-121995A stack buffer overflow in the GDB client's tracepoint uploa…7.5
Are you affected by CVE-2026-121970?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST