---
id: CVE-2026-121970
title: >-
  Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature
  Forgery
summary: >-
  Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains
  an improper cryptographic signature verification vulnerability in the
  recurring-payment webhook handler that allows unauthenticated attackers to
  forge webhook…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-347
vendor: wphostingdev
product: Pay with Vipps and MobilePay for WooCommerce
affected:
  - pay_with_vipps_and_mobilepay_for_woocommerce >= 5.0.0 < 6.4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:46:57.425233Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:47:15.201Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121970'
references:
  - url: 'https://wordpress.org/plugins/woo-vipps/#developers'
    label: Vendor Patch
  - url: >-
      https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/changelog.txt
  - url: >-
      https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/includes/wc-vipps-recurring.php
  - url: >-
      https://www.vulncheck.com/advisories/pay-with-vipps-and-mobilepay-for-woocommerce-before-webhook-signature-forgery
    label: >-
      VulnCheck Advisory: Pay with Vipps and MobilePay for WooCommerce before
      6.4.1 Webhook Signature Forgery
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.497Z'
epss: 0.00187
epssPercentile: 0.0839
---

## Overview

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.

## Affected

- `pay_with_vipps_and_mobilepay_for_woocommerce >= 5.0.0 < 6.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.