corvusinfo CorvusPay WooCommerce Payment Gateway Plugin up to 2.7.4 REST Endpoint success corvuspay_success_handler order_number permission

Summaryinfo

A vulnerability marked as problematic has been reported in corvusinfo CorvusPay WooCommerce Payment Gateway Plugin up to 2.7.4. The affected element is the function corvuspay_success_handler of the file /wp-json/corvuspay/success/ of the component REST Endpoint. This manipulation of the argument order_number causes permission. This vulnerability is registered as CVE-2026-9027. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in corvusinfo CorvusPay WooCommerce Payment Gateway Plugin up to 2.7.4 and classified as problematic. Affected by this vulnerability is the function corvuspay_success_handler of the file /wp-json/corvuspay/success/ of the component REST Endpoint. The manipulation of the argument order_number with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect integrity. The summary by CVE is:

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST /wp-json/corvuspay/success/` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.

The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-9027 since 05/19/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/09/2026). MITRE ATT&CK project uses the attack technique T1222 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42560). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Vendor

• corvusinfo

Name

• CorvusPay WooCommerce Payment Gateway Plugin

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion