CVE-2026-9028: CorvusPay WooCommerce Plugin Authorization Bypass Allows Order Cancellation

Technical summary

CVE-2026-9028 is an authorization bypass vulnerability (CWE-862) in the CorvusPay WooCommerce Payment Gateway plugin. The vulnerable endpoint `/wp-json/corvuspay/cancel/` fails to validate that the requesting user has permission to cancel a given order before processing the cancellation request. The lack of authentication checks on this REST endpoint allows unauthenticated attackers to supply arbitrary order identifiers and execute cancellations without proof of ownership or admin privileges. The vulnerability exists across all versions up to 2.7.4.

Business impact

Order cancellations initiated by unauthorized parties disrupt order fulfillment workflows, damage customer trust, and create operational chaos. Merchants using CorvusPay may face unexpected revenue loss from cancelled orders, customer service burden from confused buyers, and potential chargebacks or disputes. The ability to cancel orders at scale could be weaponized for competitive harm or simple disruption. Additionally, the incident may trigger PCI DSS compliance concerns if payment processing records are inconsistent with actual transaction states.

Affected systems

WordPress installations running the CorvusPay WooCommerce Payment Gateway plugin in versions 2.7.4 and earlier are vulnerable. Any WooCommerce store using this plugin as a payment method is in scope. The attack surface is limited to websites that have the plugin installed and active, but no further conditions (such as specific WordPress versions or configurations) are mentioned in the CVE record.

Exploitability

This vulnerability is highly exploitable. No authentication is required, the attack is trivial to execute (a simple HTTP request with an order number parameter), and the barrier to discovery is low—an attacker needs only to observe the REST endpoint structure or perform basic reconnaissance. The CVSS score of 5.3 (MEDIUM) reflects the absence of confidentiality or availability impact; the integrity impact is direct and intentional but not catastrophic at the API level. However, the operational and business impact may be severe depending on order volume and transaction sensitivity.

Remediation

Merchants must update the CorvusPay WooCommerce Payment Gateway plugin to a patched version released after 2.7.4. Verify the availability of a security update from the plugin vendor and apply it immediately. Until patching is complete, consider disabling the CorvusPay payment method if alternative payment gateways are available, or implement network-level access controls to restrict REST API requests from untrusted sources.

Patch guidance

Check the official CorvusPay plugin repository or vendor website for a security release addressing version 2.7.4 and earlier. Apply the update through the WordPress plugin administration interface or via manual download and installation. After patching, verify that the `/wp-json/corvuspay/cancel/` endpoint now requires proper authentication and authorization. Consider enabling WordPress security logging or audit trails to detect any suspicious cancellation activity that occurred prior to patching.

Detection guidance

Monitor access logs for requests to `/wp-json/corvuspay/cancel/` endpoints, particularly those originating from untrusted or external IP addresses. Correlate timing of these requests with unexpected order cancellations in your WooCommerce transaction logs. Review order cancellation history for CorvusPay orders placed by customers who did not initiate the cancellations themselves. Implement rate limiting on REST API endpoints to reduce the blast radius of automated cancellation attempts. Use WordPress security plugins with REST API monitoring capabilities to flag unauthorized endpoint access.

Why prioritize this

Although the CVSS base score is MEDIUM (5.3), the practical risk to e-commerce operations is substantial. The ease of exploitation, absence of any authentication requirement, and direct manipulation of critical business objects (orders) elevate this beyond a typical MEDIUM-severity defect. Organizations running CorvusPay should prioritize patching ahead of lower-impact vulnerabilities. The lack of KEV designation does not reduce urgency for affected merchants.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible, low-complexity attack with no privilege requirements and no user interaction, but limited to integrity impact (order state modification). Confidentiality and availability remain unaffected in the attack vector itself. However, downstream business and operational impacts (revenue loss, customer dissatisfaction, dispute resolution) may exceed the base score implications. Risk should be contextualized by order volume, payment processing value, and the organization's ability to rapidly patch.

Frequently asked questions