CVE-2026-87979 – The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request sign

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user’s account and to enumerate registered accounts.