CVE-2026-9027: CorvusPay WooCommerce Plugin Payment Bypass via Signature Validation Failure

Technical summary

The vulnerability exists in the `corvuspay_success_handler` function, which registers a publicly accessible REST endpoint at `POST /wp-json/corvuspay/success/` with no permission checks (`'permission_callback' => '__return_true'`). The handler invokes `$this->client->validate->signature()` to verify the cryptographic signature of the incoming request and stores the boolean result in variable `$res`. However, this result is never evaluated in a conditional statement—it is only written to the debug log. Execution unconditionally proceeds to `$order->payment_complete()`, which marks the order as paid. An unauthenticated attacker can construct a POST request with an arbitrary or forged signature value and supply a target order number via the `order_number` parameter. Because WooCommerce order IDs are sequential integers, enumeration requires no authentication or prior knowledge of valid orders. This represents a direct failure to validate cryptographic signatures before trusting external payment data, classified under CWE-347 (Improper Verification of Cryptographic Signature).

Business impact

This vulnerability enables direct revenue loss and fraud at scale. An attacker can claim free merchandise or services by bypassing payment entirely. The ease of order enumeration (sequential IDs) means attackers can systematically target multiple orders in bulk. Affected merchants face chargebacks, inventory loss, and reputational damage. Customer trust is compromised if payment records are forged. Depending on transaction volume and order values, a single compromised store could suffer thousands of dollars in losses before detection. The vulnerability affects all versions of the plugin up to 2.7.4, meaning any unpatched deployment is at immediate risk.

Affected systems

All installations of the CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 and earlier are affected. The plugin runs on WordPress sites using WooCommerce for e-commerce. Impact is limited to sites actively using this specific payment gateway; sites using other payment processors are not affected. The vulnerability requires no special network access or configuration—any public WordPress site using the plugin is accessible to attackers. Sites behind WAF or IP-restriction rules may have some mitigation, but those protections are not substitutes for patching.

Exploitability

Exploitation is trivial. An attacker needs only to send an HTTP POST request to a known URL pattern (`/wp-json/corvuspay/success/`) with basic parameters. No authentication is required, no social engineering is needed, and no user interaction is required. The attacker does not need to know valid order IDs in advance—they can enumerate them by incrementing sequential integers. Proof-of-concept exploitation requires minimal technical skill. The CVSS score of 5.3 (MEDIUM) reflects that while integrity impact is present (orders marked as paid fraudulently), there is no confidentiality loss and no denial of service component. However, the practical ease of exploitation and lack of any access controls make this a high-priority operational risk despite the moderate CVSS rating.

Remediation

The immediate remediation is to upgrade the CorvusPay WooCommerce Payment Gateway plugin to a patched version released after 2.7.4. Verify the patched version against the vendor advisory to confirm the signature validation logic has been corrected—specifically, that the result of `validate->signature()` is now evaluated in a conditional before `$order->payment_complete()` is called. Pending patch deployment, consider temporarily disabling the CorvusPay payment method on affected sites or restricting REST endpoint access via web server rules. Because the vulnerability does not require authentication, network-level controls (IP whitelisting, WAF rules blocking POST to `/wp-json/corvuspay/success/`) can provide interim defense but should not be relied upon as a permanent solution.

Patch guidance

Check the CorvusPay plugin vendor advisory for the specific patched version that addresses CWE-347 signature validation. Update through the WordPress plugin management interface or manually, depending on your deployment workflow. After patching, verify the update took effect by checking the installed plugin version. Test the payment workflow end-to-end with a valid payment to ensure the patch does not break legitimate transactions. If your site uses automation to update plugins, ensure this plugin is included in the update scope and monitor logs after the update for any integration failures.

Detection guidance

Monitor access logs for POST requests to `/wp-json/corvuspay/success/`. Legitimate payment confirmations should come from CorvusPay's infrastructure (specific IP ranges documented by CorvusPay); unexpected sources indicate attack attempts. Review WooCommerce order logs and transaction records for orders marked as paid without corresponding payment processor records—this is a strong indicator of exploitation. Enable debug logging in the plugin if available; forged signature attempts will appear in logs if logging is enabled. Consider setting up alerts in your SIEM for sequential order number enumeration patterns in the success endpoint, as attackers may probe multiple order IDs in rapid succession. Inspect orders marked as paid in the last 24-48 hours before you knew of the vulnerability to assess if your site was already targeted.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability should be treated with HIGH operational priority because exploitation is trivial, requires no access controls, and leads to direct financial loss. The lack of any authentication, the public accessibility of the REST endpoint, and the sequential order ID enumeration all combine to make this a low-friction attack for adversaries. A single attacker can compromise dozens or hundreds of orders in a short time window. The business impact—complete bypass of payment collection—is severe. Any store using this payment gateway should patch within hours or days, not weeks.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects MEDIUM severity: Attack Vector is Network (AV:N), Attack Complexity is Low (AC:L), Privileges Required are None (PR:N), User Interaction is None (UI:N), Scope is Unchanged (S:U), with Integrity Impact as Low (I:L) and no Confidentiality or Availability impact. However, this score understates operational risk because the 'Low' integrity impact does not fully capture the real-world consequence of fraudulent payment marking—which is complete financial loss for the merchant. The lack of any authentication requirement and the trivial enumeration mechanism further elevate practical exploitability beyond what the 'Low' complexity rating alone conveys. Organizations should apply a business-context multiplier: treat this as HIGH priority despite the MEDIUM CVSS.

Frequently asked questions