---
id: "CVE-2026-121970"
kind: "vulnerability"
aliases: ["CVE-2026-121970"]
title: "Vipps and MobilePay WooCommerce plugin: forged webhooks cancel subscriptions"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mobilepay", "package", "subscriptions", "vipps", "woo-vipps", "woocommerce", "wordpress"]
not_affected_if: ["fixed-version", "no-recurring-payments", "webhook-secret-set"]
published_at: "2026-11-04T13:17:29+00:00"
first_seen_at: "2026-11-04T13:27:04+00:00"
updated_at: "2026-11-04T13:28:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121970", "first_seen_at": "2026-11-04T13:27:04+00:00"}]
---

# Vipps and MobilePay WooCommerce plugin: forged webhooks cancel subscriptions

The woo-vipps WordPress plugin before 6.4.1 accepts recurring-payment webhooks signed with an empty key when no webhook secret is stored. An unauthenticated attacker can forge a recurring.agreement-stopped.v1 event and cancel a victim's active WooCommerce subscription.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed woo-vipps plugin version in the WordPress admin plugin list, or in the plugin header of `woo-vipps/woo-vipps.php`
- Check whether a webhook secret is configured in the plugin's Vipps MobilePay settings; the sources do not say how this is stored

## Fix

- woo-vipps: move to `6.4.1` or later

## Timeline

- 2026-11-04T13:27:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121970

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/pay-with-vipps-and-mobilepay-for-woocommerce-before-webhook-signature-forgery

## From the sources

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_