The CorvusPay WooCommerce Payment Gateway plugin for WordPress contains an improper verification of a cryptographic signature (CWE‑347). An unauthenticated attacker can POST to the /wp-json/corvuspay/success/ REST endpoint with an arbitrary or forged signature value; because the plugin logs the validation result but never checks it, the order is always marked as complete. This allows an attacker to obtain goods or services without payment, directly impacting merchant revenue and customer trust.

Any WordPress site that installs the CorvusPay WooCommerce Payment Gateway plugin from corvusinfo, all versions up to and including 2.7.4, is susceptible. The flaw resides in the plugin code that handles the /wp-json/corvuspay/success/ endpoint and the order completion logic.

With a CVSS score of 5.3 the flaw is of moderate severity. The EPSS score indicates a low exploitation probability of less than 1%, and it is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated POST request to the success endpoint containing an arbitrary or forged signature and a valid order_number; because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the order_number POST parameter, requiring no prior knowledge of the victim order.