Is CVE-2026-6939 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6939 being exploited in the wild.

How severe is CVE-2026-6939?

High severity, with a CVSS score of 7.2, published 11 July 2026.

Which products and versions are affected?

Corvus Info CorvusPay WooCommerce Payment Gateway up to, and including, 2.7.4.

Is there a fix for CVE-2026-6939?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6939 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6939?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6939: CorvusPay WooCommerce Payment Gateway Stored XSS in approval_code

CVE-2026-6939 · Severity: high · CVSS 7.2 · Published 2026-07-11

The CorvusPay WooCommerce Payment Gateway plugin for WordPress, which handles online credit card transactions for e-commerce sites, contains a security flaw. An attacker can inject malicious scripts into the website's database without needing to log in. These scripts could be used to steal customer information or hijack administrative sessions when a site user or administrator views certain pages.

Quick answers

Is CVE-2026-6939 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6939 being exploited in the wild.
How severe is CVE-2026-6939?: High severity, with a CVSS score of 7.2, published 11 July 2026.
Which products and versions are affected?: Corvus Info CorvusPay WooCommerce Payment Gateway up to, and including, 2.7.4.
Is there a fix for CVE-2026-6939?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6939 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6939?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the 'approval_code' parameter. The vulnerability is accessible via the unauthenticated REST endpoint 'POST /wp-json/corvuspay/success/', which is registered with a 'permission_callback' set to '__return_true'. While the plugin performs a signature validation step, it only logs the result of the validation without halting execution, allowing an attacker to provide an arbitrary signature and store malicious scripts in the database. These scripts execute when a user accesses the affected page. The issue is present in all versions up to and including 2.7.4.

Affected products

Corvus Info CorvusPay WooCommerce Payment Gateway up to, and including, 2.7.4

Timeline

2026-07-11: advisory: Advisory published by Wordfence and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.