Junglewise Threat Intelligence

CVE-2026-6939: CorvusPay WooCommerce Payment Gateway Stored XSS in approval_code

CVE-2026-6939 · Severity: high · CVSS 7.2 · Published 2026-07-11

Technologies: Corvus Info CorvusPay WooCommerce Payment Gateway.

Executive brief

The CorvusPay WooCommerce Payment Gateway plugin for WordPress, which handles online credit card transactions for e-commerce sites, contains a security flaw. An attacker can inject malicious scripts into the website's database without needing to log in. These scripts could be used to steal customer information or hijack administrative sessions when a site user or administrator views certain pages.

Technical details

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the 'approval_code' parameter. The vulnerability is accessible via the unauthenticated REST endpoint 'POST /wp-json/corvuspay/success/', which is registered with a 'permission_callback' set to '__return_true'. While the plugin performs a signature validation step, it only logs the result of the validation without halting execution, allowing an attacker to provide an arbitrary signature and store malicious scripts in the database. These scripts execute when a user accesses the affected page. The issue is present in all versions up to and including 2.7.4.

Affected products

  • Corvus Info CorvusPay WooCommerce Payment Gateway up to, and including, 2.7.4

Timeline

  • 2026-07-11: advisory: Advisory published by Wordfence and NVD.

References