EUVD-2026-39692
GHSA-4jhm-9928-rqx4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network callback with no UI yields AV:N/AC:L/PR:N/UI:N; broken-auth state tampering gives I:H while C:N/A:N reflect no data exposure or downtime.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (versions 2.7.4 and earlier) lets unauthenticated remote attackers manipulate the payment/integration workflow without valid credentials, per the CVSS 3.1 vector (AV:N/PR:N) and CWE-288. The flaw scores 7.5 with integrity impact only (I:H, C:N, A:N), meaning an attacker can tamper with trusted state - most plausibly forging payment confirmation/callback validation - rather than steal data or take a site down. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The affected component is the CorvusPay WooCommerce integration plugin, which bridges a WordPress/WooCommerce store to the CorvusPay payment processor, typically handling order checkout, redirect, and asynchronous payment-status callbacks. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the plugin exposes a code path that reaches a protected action without performing the expected authentication or signature/verification check - a recurring pattern in payment-gateway plugins where the IPN/return endpoint trusts attacker-controllable input instead of cryptographically validating the processor's callback. Because the CVSS vector marks Integrity High with Confidentiality and Availability None, the practical effect is unauthorized state change (e.g., marking orders paid or altering integration logic) rather than data exposure, despite the source 'Information Disclosure' tag.
RemediationAI
No exact fixed version is provided in the supplied data, so the patched build cannot be independently confirmed here; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/corvuspay-woocommerce-integration/vulnerability/wordpress-corvuspay-woocommerce-payment-gateway-plugin-2-7-4-broken-authentication-vulnerability?_s_id=cve) for the vendor's fixed release and upgrade beyond 2.7.4 as soon as it is published. Until a patched version is applied, the most effective compensating control is to place the vulnerable plugin's callback/return endpoints behind a virtual-patch WAF rule (Patchstack and similar offer one) or restrict access to the CorvusPay IPN/callback URLs to CorvusPay's published source IP ranges at the web server or firewall - accepting the trade-off that IP changes by the processor could break legitimate payment confirmations. As an interim measure, manually reconcile order-paid status against the CorvusPay merchant dashboard rather than trusting plugin-reported payment state, and consider temporarily disabling the gateway if transaction volume is low enough to tolerate it.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today