CVE-2026-9027

Name of the Vulnerable Software and Affected Versions CorvusPay WooCommerce Payment Gateway versions prior to 2.7.5

Description An issue exists where the corvuspay success handler function registers the REST endpoint POST /wp-json/corvuspay/success/ without proper authorization checks. Although the system calls $this->client->validate->signature() to verify the cryptographic signature, the result is only recorded in a debug log and not used to control the flow of execution. Consequently, the process always reaches the payment complete() function, allowing unauthenticated attackers to mark pending orders as paid by sending a request with a forged signature. Attackers can identify target orders using the order number parameter, as these IDs are sequential integers.

Recommendations Update CorvusPay WooCommerce Payment Gateway to version 2.7.5 or later. As a temporary workaround, restrict access to the POST /wp-json/corvuspay/success/ endpoint to prevent unauthorized requests.