The Robokassa payment gateway for WooCommerce plugin, versions prior to 1.9.0, lacks verification of the authenticity of incoming payment‑notification requests. As a result, anyone can craft a request targeting the notification URL with an order identifier and force the specified WooCommerce order into a failed state. This flaw allows unauthenticated attackers to arbitrarily change the status of any order, causing financial loss and disrupting order fulfillment. The weakness is an instance of missing authorization (CWE‑862).

Any WordPress site using the Robokassa payment gateway plugin for WooCommerce with a version earlier than 1.9.0 is affected. Order identifiers are sequential, so each order can be targeted one at a time.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is under 1%, implying a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is likely unauthenticated network requests to the payment‑notification endpoint. An attacker could exploit this to convert legitimate orders into a failed status, resulting in loss of revenue, payment processing errors, or denial of service to fulfillment operations.