CVE-2026-91076
UnknownSummary
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it. This allows unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Risk Assessment
An attacker can disrupt order fulfilment across the entire shop, causing business disruption and customer dissatisfaction.
Recommendation
Update the Robokassa payment gateway for Woocommerce plugin to version 1.9.0 or later.
Other vulnerabilities in Robokassa payment gateway for Woocommerce
See all- CVE-2026-78536Medium
The Robokassa payment gateway for WooCommerce in versions up to and including 1.8.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control enables unauthorized operations.
- CVE-2026-91017Low
The Robokassa payment gateway for WooCommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Original NVD description (English source)
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS