CorvusPay WooCommerce Payment Gateway vulnerabilities

The CorvusPay WooCommerce Payment Gateway plugin for WordPress, up to version 2.7.4, contains an authorization bypass vulnerability that allows unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method. The attack is performed by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.

The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 contains a payment bypass vulnerability. The `corvuspay_success_handler` function registers a REST endpoint `POST /wp-json/corvuspay/success/` without authentication, and the cryptographic signature validation result is never evaluated conditionally, allowing any pending order to be marked as paid.

The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 is vulnerable to stored cross-site scripting via the 'approval_code' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ has permission_callback set to __return_true, and signature validation only logs the result without stopping execution, allowing an attacker to store a malicious approval_code unchallenged.

The CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 and earlier contains a broken authentication vulnerability that can be exploited without authentication. An attacker can exploit this flaw without having an account in the system.