CVE-2026-9028
MediumCVSS 5.3Summary
The CorvusPay WooCommerce Payment Gateway plugin for WordPress, up to version 2.7.4, contains an authorization bypass vulnerability that allows unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method. The attack is performed by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
Risk Assessment
The risk involves the ability for unauthorized parties to unilaterally cancel orders, potentially leading to financial losses, disruption of order fulfillment, and loss of customer trust.
Recommendation
It is recommended to immediately update the CorvusPay WooCommerce Payment Gateway plugin to the latest available version that fixes this vulnerability. Until the update is applied, consider temporarily disabling the /wp-json/corvuspay/cancel/ REST endpoint using Web Application Firewall (WAF) rules.
Other vulnerabilities in CorvusPay WooCommerce Payment Gateway
See all- CVE-2026-9027Medium
The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 contains a payment bypass vulnerability. The `corvuspay_success_handler` function registers a REST endpoint `POST /wp-json/corvuspay/success/` without authentication, and the cryptographic signature validation result is never evaluated conditionally, allowing any pending order to be marked as paid.
- CVE-2026-6939High
The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 is vulnerable to stored cross-site scripting via the 'approval_code' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ has permission_callback set to __return_true, and signature validation only logs the result without stopping execution, allowing an attacker to store a malicious approval_code unchallenged.
- CVE-2026-56029High
The CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 and earlier contains a broken authentication vulnerability that can be exploited without authentication. An attacker can exploit this flaw without having an account in the system.
Original NVD description (English source)
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.