CVE-2026-9027: CorvusPay WooCommerce Payment Gateway payment bypass via signature spoofing

CVE-2026-9027 · Severity: medium · CVSS 5.3 · Published 2026-07-09

The CorvusPay plugin for WooCommerce, which allows WordPress sites to accept online payments, contains a flaw that allows users to bypass the payment process. An attacker can trick the system into marking an order as 'paid' without actually transferring any funds. This could lead to financial loss for merchants as goods or services might be provided for free.

Technologies: CorvusPay WooCommerce Payment Gateway. Vendors: CorvusPay.

Quick answers

Is CVE-2026-9027 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9027 being exploited in the wild.
How severe is CVE-2026-9027?
Medium severity, with a CVSS score of 5.3, published 9 July 2026.
Which products and versions are affected?
CorvusPay WooCommerce Payment Gateway <= 2.7.4.
Is there a fix for CVE-2026-9027?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9027 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9027?
Check whether you run CorvusPay WooCommerce Payment Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `corvuspay_success_handler` function, which registers a public REST endpoint at `POST /wp-json/corvuspay/success/`. While the code calls a signature validation method, it fails to check the resulting boolean value before proceeding to call `$order->payment_complete()`. An unauthenticated attacker can exploit this by sending a POST request with a forged signature and a target `order_number`. Since WooCommerce order IDs are sequential, attackers can easily enumerate and target pending orders to obtain goods or services without valid payment.

Affected products

  • CorvusPay CorvusPay WooCommerce Payment Gateway <= 2.7.4

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.