CVE-2026-6939
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 is vulnerable to stored cross-site scripting via the 'approval_code' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ has permission_callback set to __return_true, and signature validation only logs the result without stopping execution, allowing an attacker to store a malicious approval_code unchallenged.
Risk Assessment
The risk includes session hijacking, data theft, or malware distribution through script execution in the victim's browser. The attack requires no authentication, increasing its potential impact.
Recommendation
Immediately update the CorvusPay WooCommerce Payment Gateway plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable the plugin or block access to the REST endpoint /wp-json/corvuspay/success/ for untrusted requests.
Other vulnerabilities in CorvusPay WooCommerce Payment Gateway
See all- CVE-2026-9028Medium
The CorvusPay WooCommerce Payment Gateway plugin for WordPress, up to version 2.7.4, contains an authorization bypass vulnerability that allows unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method. The attack is performed by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
- CVE-2026-9027Medium
The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 contains a payment bypass vulnerability. The `corvuspay_success_handler` function registers a REST endpoint `POST /wp-json/corvuspay/success/` without authentication, and the cryptographic signature validation result is never evaluated conditionally, allowing any pending order to be marked as paid.
- CVE-2026-56029High
The CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 and earlier contains a broken authentication vulnerability that can be exploited without authentication. An attacker can exploit this flaw without having an account in the system.
Original NVD description (English source)
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.