CVE-2026-16947

Name of the Vulnerable Software and Affected Versions Total processing card payments for WooCommerce versions prior to 7.4

Description An issue exists where the plugin fails to validate a user-supplied path used to construct a server-side verification request and does not verify the authenticity of the resulting response. This allows unauthenticated attackers to perform a Server-Side Request Forgery (SSRF)—a technique where an attacker induces a server-side application to make requests to an unintended location—to redirect the request to an arbitrary host. This can lead to the disclosure of the merchant's payment-gateway credentials and allow attackers to forge success responses, marking arbitrary WooCommerce orders as paid.

Recommendations Update Total processing card payments for WooCommerce to version 7.4 or later.