CVE-2026-9027
MediumCVSS 5.3Summary
The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 contains a payment bypass vulnerability. The `corvuspay_success_handler` function registers a REST endpoint `POST /wp-json/corvuspay/success/` without authentication, and the cryptographic signature validation result is never evaluated conditionally, allowing any pending order to be marked as paid.
Risk Assessment
An unauthenticated attacker can mark any pending WooCommerce order as fully paid by sending a POST request with an arbitrary or forged signature, enabling them to obtain goods or services without payment. Since WooCommerce order IDs are sequential integers, target orders are easily enumerable.
Recommendation
Immediately update the CorvusPay WooCommerce Payment Gateway plugin to the latest available version that fixes this vulnerability. As a temporary workaround, disable the plugin or apply WAF rules to block access to the `/wp-json/corvuspay/success/` endpoint.
Other vulnerabilities in CorvusPay WooCommerce Payment Gateway
See all- CVE-2026-9028Medium
The CorvusPay WooCommerce Payment Gateway plugin for WordPress, up to version 2.7.4, contains an authorization bypass vulnerability that allows unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method. The attack is performed by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
- CVE-2026-6939High
The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 is vulnerable to stored cross-site scripting via the 'approval_code' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ has permission_callback set to __return_true, and signature validation only logs the result without stopping execution, allowing an attacker to store a malicious approval_code unchallenged.
- CVE-2026-56029High
The CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 and earlier contains a broken authentication vulnerability that can be exploited without authentication. An attacker can exploit this flaw without having an account in the system.
Original NVD description (English source)
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.