Mmastodon TechnologyCybersecurity first seen 3 d ago, last 3 d ago, peak #1

Forged webhook flaw lets attackers cancel WooCommerce subscriptions via Vipps plugin

Original: CVE-2026-121970: Pay with Vipps and MobilePay for WooCommerce versions 5.0.0 through 6.4.0 can accept forged recurring-p

A newly published vulnerability, CVE-2026-121970, affects the Pay with Vipps and MobilePay plugin for WooCommerce in versions 5.0.0 through 6.4.0. When no webhook secret is stored, unauthenticated attackers can send forged recurring-payment webhooks and cancel a customer's active subscription. Security researchers are circulating the advisory, noting that no exploitation has been confirmed so far.

Why now: A newly disclosed payment-plugin vulnerability is being flagged in cybersecurity circles, prompting merchants to check their WooCommerce setups.

VippsMobilePayWooCommerceCVE-2026-121970

Open on mastodon →

Rank over time, top of the chart is #1. 2 snapshots from 3 d ago to 3 d ago.

Evidence

• CVE-2026-121970: Pay with Vipps and MobilePay for WooCommerce versions 5.0.0 through 6.4.0 can accept forged recurring-payment webhooks when no webhook secret is stored. Unauthenticated attackers can use this to cancel a customer's active subscription. No exploitation has been… · suriq@infosec.exchange · 1

API: https://socialmediatrends-api.osmike.com/v1/trends/4872841