CVE-2026-9027 Details
Description
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.
A vulnerability in the CorvusPay WooCommerce Payment Gateway plugin for WordPress allows for payment bypass through improper verification of cryptographic signatures. This issue affects all versions up to and including 2.7.4. The vulnerability arises in the 'corvuspay_success_handler' function, which registers a REST endpoint that handles payment status updates. The endpoint, 'POST /wp-json/corvuspay/success/', is accessible without authentication. While the function attempts to validate the signature of incoming requests, it fails to properly assess the validation result before proceeding to mark orders as paid. As a result, unauthenticated attackers can exploit this flaw by sending forged signature values to the endpoint, thereby falsely indicating that a payment has been made. This allows them to obtain goods or services without actually completing a transaction. The vulnerability is particularly concerning because WooCommerce order IDs are sequential, making it easy to target specific orders by simply incrementing the order number.
Users are advised to update the CorvusPay WooCommerce Payment Gateway plugin to version 2.7.5 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CorvusPay WooCommerce Payment Gateway | <= 2.7.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |