# CVE-2026-9028: CorvusPay WooCommerce Payment Gateway authorization bypass in REST API

Source: https://junglewise.ai/threats/cve-2026-9028-corvuspay-woocommerce-payment-gateway-authorization-bypass-in-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-9028 · Severity: medium · CVSS 5.3 · Published 2026-07-09

The CorvusPay WooCommerce Payment Gateway plugin for WordPress, which allows online stores to process payments, contains a security flaw that allows unauthorized individuals to cancel customer orders. By sending a specific request to the website, an attacker can cancel any order processed through CorvusPay without needing to log in. This could lead to significant operational disruption and loss of revenue for affected merchants.

Technologies: [CorvusPay WooCommerce Payment Gateway](https://junglewise.ai/threats/technologies/corvuspay-woocommerce-payment-gateway). Vendors: [CorvusPay](https://junglewise.ai/threats/vendors/corvuspay).

## Quick answers

**Is CVE-2026-9028 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9028 being exploited in the wild.

**How severe is CVE-2026-9028?** Medium severity, with a CVSS score of 5.3, published 9 July 2026.

**Which products and versions are affected?** CorvusPay WooCommerce Payment Gateway Up to, and including, 2.7.4.

**Is there a fix for CVE-2026-9028?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9028 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9028?** Check whether you run CorvusPay WooCommerce Payment Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in all versions up to and including 2.7.4. The vulnerability exists within the REST API endpoint `/wp-json/corvuspay/cancel/`, which fails to verify if the requester has the appropriate permissions to modify order statuses. An unauthenticated remote attacker can exploit this by providing an arbitrary order number to the endpoint, resulting in the cancellation of that specific WooCommerce order. This issue was addressed in version 2.7.5 or later via a changeset that implemented proper authorization checks.

## Affected products

- CorvusPay CorvusPay WooCommerce Payment Gateway Up to, and including, 2.7.4

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: advisory

## References

- [https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php](https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php)
- [https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php](https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php)
- [https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-order-corvuspay.php](https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-order-corvuspay.php)
- [https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-gateway-corvuspay.php](https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-gateway-corvuspay.php)
- [https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-gateway-corvuspay.php](https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-gateway-corvuspay.php)
- [https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-order-corvuspay.php](https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.4/includes/class-wc-order-corvuspay.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration](https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration)

## Related threats

- [CorvusPay WooCommerce Payment Gateway payment bypass via signature spoofing](https://junglewise.ai/threats/cve-2026-9027-corvuspay-woocommerce-payment-gateway-payment-bypass-via-signature)
- [CorvusPay WooCommerce Payment Gateway authentication bypass](https://junglewise.ai/threats/cve-2026-56029-corvuspay-woocommerce-payment-gateway-authentication-bypass)