{"id":"CVE-2026-121970","kind":"vulnerability","aliases":["CVE-2026-121970"],"related":[],"title":"Vipps and MobilePay WooCommerce plugin: forged webhooks cancel subscriptions","description":"Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.","summary":"The woo-vipps WordPress plugin before 6.4.1 accepts recurring-payment webhooks signed with an empty key when no webhook secret is stored. An unauthenticated attacker can forge a recurring.agreement-stopped.v1 event and cancel a victim's active WooCommerce subscription.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mobilepay","package","subscriptions","vipps","woo-vipps","woocommerce","wordpress"],"not_affected_if":["fixed-version","no-recurring-payments","webhook-secret-set"],"how_to_check":"- Check the installed woo-vipps plugin version in the WordPress admin plugin list, or in the plugin header of `woo-vipps/woo-vipps.php`\n- Check whether a webhook secret is configured in the plugin's Vipps MobilePay settings; the sources do not say how this is stored","fix":"- woo-vipps: move to `6.4.1` or later","status":"open","published_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:04+00:00","triaged_at":"2026-11-04T13:28:09+00:00","updated_at":"2026-11-04T13:28:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T13:28:09Z","model":"claude-haiku-5-5","output":{"fix":"- woo-vipps: move to `6.4.1` or later","reach":"internet","title":"Vipps and MobilePay WooCommerce plugin: forged webhooks cancel subscriptions","impact":"medium","summary":"The woo-vipps WordPress plugin before 6.4.1 accepts recurring-payment webhooks signed with an empty key when no webhook secret is stored. An unauthenticated attacker can forge a recurring.agreement-stopped.v1 event and cancel a victim's active WooCommerce subscription.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","woo-vipps","vipps","mobilepay","subscriptions"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker cancels a victim's active WooCommerce subscription via forged webhook","analyst_note":"","how_to_check":"- Check the installed woo-vipps plugin version in the WordPress admin plugin list, or in the plugin header of `woo-vipps/woo-vipps.php`\n- Check whether a webhook secret is configured in the plugin's Vipps MobilePay settings; the sources do not say how this is stored","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","webhook-secret-set","no-recurring-payments"],"who_is_affected":"Stores running the woo-vipps plugin before 6.4.1 that take recurring Vipps or MobilePay payments through WooCommerce subscriptions. The exposure depends on the webhook handler being reachable from the internet and no local webhook secret being stored, which the sources describe as the vulnerable condition. Sites on a fixed version or without recurring Vipps or MobilePay agreements can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4266,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121970':12A,15A '-2026':11A,14A '6.4.1':32B,77C 'accept':33B 'activ':63B,157C 'agreementid':144C 'allow':93C 'attack':51B,95C,134C 'cancel':8A,59B,153C 'code':109C 'comparison':129C 'comput':118C 'contain':78C 'craft':136C 'cryptograph':81C 'cve':10A,13A 'empti':41B,115C,124C,149C 'empty-key':148C 'equal':133C 'event':57B,140C 'fail':110C 'forg':6A,53B,97C 'handler':91C 'hash':132C 'hmac':120C 'improp':80C 'instead':130C 'key':42B,121C,150C 'known':143C 'local':102C 'loos':128C 'match':147C 'mobilepay':3A,16B,70C 'packag':17B 'pay':66C 'payment':36B,89C 'plugin':5A,30B 'recur':35B,88C 'recurring-pay':34B,87C 'recurring.agreement':55B,138C 'request':99C 'return':112C 'secret':46B,104C,116C 'sign':38B 'signatur':82C,151C 'stopped.v1':56B,139C 'store':48B,106C 'string':125C 'subscript':9A,18B,65B,159C 'unauthent':50B,94C 'use':126C 'verif':83C 'victim':61B,155C 'vipp':1A,19B,22B,28B,68C,75C 'vulner':84C 'webhook':7A,37B,45B,90C,98C,103C 'woo':21B,27B,74C 'woo-vipp':20B,26B,73C 'woocommerc':4A,23B,64B,72C,158C 'wordpress':24B,29B","nicknames":[],"mitigations":[],"who_affected":"Stores running the woo-vipps plugin before 6.4.1 that take recurring Vipps or MobilePay payments through WooCommerce subscriptions. The exposure depends on the webhook handler being reachable from the internet and no local webhook secret being stored, which the sources describe as the vulnerable condition. Sites on a fixed version or without recurring Vipps or MobilePay agreements can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mobilepay","package","subscriptions","vipps","woocommerce","woovipps","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121970","severity":null,"published_at":"2026-11-04T13:17:29+00:00","modified_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:04+00:00","fetched_at":"2026-11-04T13:27:04+00:00","note":null}],"documents":[{"id":67101,"url":"https://www.vulncheck.com/advisories/pay-with-vipps-and-mobilepay-for-woocommerce-before-webhook-signature-forgery","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}