Executive brief
The Robokassa payment gateway plugin for WooCommerce allows payment processors to mark orders as paid or on-hold in WordPress online stores. When the optional deferred-payment feature is enabled, the plugin fails to verify that payment notifications are authentic, enabling attackers to forge fake payment confirmations and mark arbitrary orders as paid without actual payment being made or any valid signature.
Technical details
This is an authentication bypass vulnerability in the Robokassa payment gateway WordPress plugin that affects the deferred-payment feature. The vulnerable component fails to cryptographically verify incoming payment notification callbacks, allowing unauthenticated attackers to forge JWT tokens or craft fake notifications without a valid signature. The attack is network-reachable and requires no prior authentication, but is only exploitable when the non-default deferred-payment feature is explicitly enabled. An attacker can modify the payment status of arbitrary WooCommerce orders from pending to paid or on-hold, resulting in financial loss and order fulfillment without payment. The vulnerability was patched in version 1.8.9.
Affected products
- Robokassa Payment Gateway for WooCommerce before 1.8.9
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory
- 2026-09-29: patched: PoC release scheduled for September 29, 2026