Description
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
Published: 2026-07-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CorvusPay WooCommerce Payment Gateway for WordPress omits proper authorization checks, allowing an unauthenticated attacker to send a request to the REST endpoint "/wp-json/corvuspay/cancel/" with any "order_number" value. The plugin then cancels that order, which can result in loss of revenue and damage to customer trust. The flaw is a classic authorization bypass, classified as CWE‑862.

Affected Systems

WordPress sites that use the CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 or earlier are affected. All installations where the plugin is active are vulnerable regardless of user role, and the vendor is corvusinfo.

Risk and Exploitability

With a CVSS score of 5.3, the vulnerability poses a medium impact. Because the attack requires only a crafted HTTP request and no authentication, exploitation is possible, but the EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not listed but the possibility of financial loss and customer disruption makes immediate action advisable.

Generated by OpenCVE AI on July 29, 2026 at 12:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CorvusPay WooCommerce Payment Gateway to the latest available version that includes the authorization fix
  • Configure WordPress to restrict the "/wp-json/corvuspay/cancel/" REST endpoint to authenticated or privileged users only, for example by adding a capability check or using a security plugin
  • Review existing orders for unexpected cancellations, restore any incorrectly cancelled orders, and monitor order status changes for anomalies

Generated by OpenCVE AI on July 29, 2026 at 12:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Description The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
Title CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-09T12:18:39.132Z

Reserved: 2026-05-19T15:24:07.965Z

Link: CVE-2026-9028

cve-icon Vulnrichment

Updated: 2026-07-09T12:18:34.073Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T12:45:03Z

Weaknesses