CVE-2026-91076 in Robokassa Payment Gateway Plugin
Summary
by MITRE • 10/15/2026
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The Robokassa payment gateway plugin for WordPress and WooCommerce versions prior to 1.9.0 contains a critical authentication flaw that allows unauthenticated actors to manipulate e-commerce transactions. This vulnerability stems from the application's failure to verify the authenticity of incoming payment notification requests before processing them. In standard e-commerce architectures, payment gateways send asynchronous notifications or webhooks back to the merchant site upon transaction completion or status changes. These messages must be cryptographically signed and verified using shared secrets or digital signatures to ensure they originate from the legitimate payment provider. The absence of this verification mechanism means that any entity capable of sending an HTTP request to the affected endpoint can impersonate the Robokassa gateway, tricking the WooCommerce system into accepting forged status updates as genuine events.
The technical core of this flaw is a lack of input validation regarding message integrity and source authentication. When a notification arrives at the WordPress site, the plugin immediately acts on the order identifier contained within the payload without checking for valid cryptographic signatures or verifying that the request was indeed sent by Robokassa's servers. This design oversight creates a direct path for attackers to inject malicious state changes into the system. By crafting specific HTTP POST requests with sequential order IDs and setting their status to failed, an attacker can systematically alter the database records of legitimate customer orders. Since WooCommerce typically assigns incremental identifiers to new orders, these values are predictable, allowing an adversary to iterate through existing order numbers efficiently without needing prior knowledge of internal data structures or session tokens.
The operational impact of this vulnerability is severe for any business relying on automated payment processing and inventory management via WooCommerce. An attacker can force any specific order into a failed state by sending a single crafted request targeting that order's unique identifier. Because the identifiers are sequential, an automated script could potentially iterate through all active orders in a shop, systematically canceling or failing them one by one. This results in significant financial loss due to lost sales and requires manual intervention from store administrators to correct each affected transaction. Furthermore, this disruption can damage customer trust if clients receive erroneous cancellation emails despite having paid for their goods, leading to increased support ticket volume and potential reputational harm.
From a classification perspective, this vulnerability aligns with CWE-347 Improper Verification of Cryptographic Signature, as the system fails to ensure that data has not been tampered with during transit or originates from an authorized source. It also maps to MITRE ATT&CK technique T1565 Data Manipulation, where adversaries modify stored data to achieve their objectives, specifically within the context of e-commerce platforms. The attack vector is classified as Network-based and requires no user interaction on the victim's side other than having a publicly accessible WordPress installation with this plugin installed.
To mitigate this risk, administrators must upgrade the Robokassa payment gateway for WooCommerce to version 1.9.0 or later immediately upon availability. This updated release implements proper cryptographic verification of incoming webhook payloads, ensuring that only authentic notifications from the official Robokassa infrastructure are processed. Until an update is applied, site owners should consider restricting access to the specific endpoint handling these notifications via firewall rules if possible, although upgrading remains the definitive solution. Additionally, implementing Web Application Firewall (WAF) rules that monitor for anomalous patterns in webhook traffic can provide a temporary layer of defense against automated exploitation attempts targeting sequential order IDs.