Webhook Signature Forgery Vulnerability in WooCommerce Plugin by WordPress

CVE-2026-121970

What is CVE-2026-121970?

An improper cryptographic signature verification vulnerability has been identified in the Pay with Vipps and MobilePay for WooCommerce plugin prior to version 6.4.1. This issue arises in the recurring-payment webhook handler, where the absence of a local webhook secret allows unauthenticated attackers to forge webhook requests. Specifically, the code does not return on an empty secret, leading to the computation of an HMAC with an empty string. This vulnerability enables attackers to craft malicious events (recurring.agreement-stopped.v1) using a known agreementId and a corresponding empty-key signature to cancel the active WooCommerce subscription of a victim, potentially causing significant disruption and financial loss.

References