CorvusPay WooCommerce Payment Gateway <= 2.7.4 — Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint
CVE-2026-9027Published · Updated Action summary
Affected: ≤2.7.4Update to 2.7.5 or newer
All remediation steps- Severity
- Medium5.3
- CVSS
- 5.3CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NWhat does this vector mean?
AV:NAttack vector- Network
AC:LAttack complexity- Low
PR:NPrivileges required- None
UI:NUser interaction- None
S:UScope- Unchanged
C:NConfidentiality- None
I:LIntegrity- Low
A:NAvailability- None
- Required access
- No account needed
- Exploit prediction (EPSS)
- No score
- CISA KEV
- Not listed
On this page8
Am I affected?
CorvusPay WooCommerce Payment Gateway corvuspay-woocommerce-integration
- Affected≤ 2.7.4
- Patched in2.7.5
Update to 2.7.5 or newer.
You are affected if you run ≤ 2.7.4. Version 2.7.5 and later are not affected by this issue.
- Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under CorvusPay WooCommerce Payment Gateway.
- No admin access? Run a passive check of your site. It reads public files only.
- No account is needed to exploit this. Treat any exposed site on an affected version as at risk.
What to do
- Update to version 2.7.5, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
- Watch CorvusPay WooCommerce Payment Gateway to get an email when the next vulnerability is published.
Advisory
Source description from Wordfence Intelligence, credited to Vijay.
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.
Exploits & references
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
More in CorvusPay WooCommerce Payment Gateway
All 4| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter ≤2.7.4Update to 2.7.5 | CVE-2026-6939 | |
| Medium5.3 | Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter ≤2.7.4Update to 2.7.5 | CVE-2026-9028 | |
| Medium5.3 | Missing Authorization ≤2.7.4Update to 2.7.5 | CVE-2026-56029 |
- High7.2Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter
≤2.7.4Update to 2.7.5
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
≤2.7.4Update to 2.7.5
- Medium5.3Missing Authorization
≤2.7.4Update to 2.7.5
Timeline
CVE published
Severity medium, CVSS 5.3
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.