CVE-2026-9028

Name of the Vulnerable Software and Affected Versions CorvusPay WooCommerce Payment Gateway versions prior to 2.7.5

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to cancel any WooCommerce order processed through the CorvusPay payment method by providing an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint via the order number parameter.

Recommendations Update CorvusPay WooCommerce Payment Gateway to version 2.7.5 or later. As a temporary mitigation, restrict access to the /wp-json/corvuspay/cancel/ REST endpoint.