CVE-2026-121970 · Package
NO FIX YET · SEE WHAT TO DO
The woo-vipps WordPress plugin before 6.4.1 accepts recurring-payment webhooks signed with an empty key when no webhook secret is stored. An unauthenticated attacker can forge a recurring.agreement-stopped.v1 event and cancel a victim's active WooCommerce subscription.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Stores running the woo-vipps plugin before 6.4.1 that take recurring Vipps or MobilePay payments through WooCommerce subscriptions. The exposure depends on the webhook handler being reachable from the internet and no local webhook secret being stored, which the sources describe as the vulnerable condition. Sites on a fixed version or without recurring Vipps or MobilePay agreements can skip it.
Not affected if fixed-version, no-recurring-payments, webhook-secret-set
Who cares mobilepay, subscriptions, vipps, woo-vipps, woocommerce, wordpress
woo-vipps/woo-vipps.php6.4.1 or laterPay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
This page as .md · .json · in your agent: get_signal("CVE-2026-121970") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.