CVE-2026-78536

MediumCVSS 6.5

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Summary

The Robokassa payment gateway for WooCommerce in versions up to and including 1.8.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control enables unauthorized operations.

Risk Assessment

An unauthenticated attacker can bypass access control mechanisms in the payment gateway, potentially leading to transaction manipulation or data exposure. This may result in financial losses.

Recommendation

Update the Robokassa gateway for WooCommerce to a version newer than 1.8.9 containing the fix. Review transaction logs for suspicious activity.

Other vulnerabilities in Robokassa payment gateway for WooCommerce

CVE-2026-91017Low
The Robokassa payment gateway for WooCommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

Original NVD description (English source)

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS