Executive brief
The CorvusPay plugin for WooCommerce, which allows WordPress sites to accept online payments, contains a flaw that allows users to bypass the payment process. An attacker can trick the system into marking an order as 'paid' without actually transferring any funds. This could lead to financial loss for merchants as goods or services might be provided for free.
Technical details
The vulnerability exists in the `corvuspay_success_handler` function, which registers a public REST endpoint at `POST /wp-json/corvuspay/success/`. While the code calls a signature validation method, it fails to check the resulting boolean value before proceeding to call `$order->payment_complete()`. An unauthenticated attacker can exploit this by sending a POST request with a forged signature and a target `order_number`. Since WooCommerce order IDs are sequential, attackers can easily enumerate and target pending orders to obtain goods or services without valid payment.
Affected products
- CorvusPay CorvusPay WooCommerce Payment Gateway <= 2.7.4
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php
- https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php
- https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-order-corvuspay.php
- https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-gateway-corvuspay.php
- https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-gateway-corvuspay.php
- https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-order-corvuspay.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration