EUVD-2026-43161
GHSA-3qh5-q7jr-f3w8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running CorvusPay plugin
-
DeliveryPOST to /wp-json/corvuspay/success/ with bogus signature
-
Exploitapproval_code XSS payload stored in DB
-
Executionadmin opens affected order page
-
Persistscript executes in admin session
-
Impacthijack session or forge actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the CorvusPay WooCommerce Payment Gateway plugin (≤ 2.7.4) installed and active on an internet-reachable WordPress site, with its public REST endpoint POST /wp-json/corvuspay/success/ accessible; the endpoint's permission_callback is __return_true and its signature validation only logs - never halts - so no valid signature, credentials, or authentication are needed to write the payload. The limiting factor is that this is stored XSS: the injected script does not fire on injection but only when a victim (typically a logged-in operator viewing the order/success page) subsequently loads the affected page, so impact depends on someone rendering the poisoned record. There is no special non-default configuration barrier beyond having the plugin active. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) reflects a network-reachable, low-complexity, unauthenticated flaw with a scope change - consistent with stored XSS where injected script executes in a different security context (e.g., a logged-in admin's browser). The elevated 7.2 relative to typical XSS stems from PR:N and the scope change. No EPSS score, KEV entry, or POC was supplied, so real-world exploitation pressure is currently unquantified: this is a Wordfence-catalogued vulnerability without confirmed active exploitation. One point warrants verification: the vector uses UI:N, yet stored XSS ordinarily requires a victim to load the injected page - the CVSS models this as scope/impact rather than user interaction, but defenders should treat 'victim views the poisoned order/success page' as a practical trigger. Overall this is a genuine but not emergency-tier issue: easy to exploit and unauthenticated, but the payoff is script execution in a victim's session (session/data theft, admin action forgery), not direct server compromise, and the plugin's deployment footprint is niche. |
| Exploit ScenarioDerived | An attacker sends a single crafted POST request to /wp-json/corvuspay/success/ with an arbitrary invalid signature and an approval_code containing a JavaScript payload; because the endpoint is public and the signature check does not stop execution, the payload is stored against an order. When a store administrator later opens that order in wp-admin (or the success page is rendered), the script runs in their authenticated session, enabling session/cookie theft or forged admin actions. No exploit code was provided, but the low attack complexity and unauthenticated network vector make this straightforward to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Stored cross-site scripting in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (all versions through 2.7.4) lets unauthenticated attackers persist arbitrary JavaScript through the 'approval_code' parameter. The plugin exposes the REST route POST /wp-json/corvuspay/success/ with permission_callback set to __return_true, and its signature check only logs failures instead of blocking execution, so an attacker with any bogus signature can write a malicious approval_code into the order record, which then executes when a store operator or user views the affected page. Reported by Wordfence; no public exploit identified at time of analysis and no EPSS or KEV data provided.
RemediationAI
Upgrade to the latest release of the CorvusPay WooCommerce Payment Gateway plugin beyond 2.7.4; an upstream fix appears in the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration), but no exact fixed version number is stated in the available data, so confirm the patched version via the Wordfence advisory before deploying. If you cannot patch immediately, apply compensating controls: restrict or block external access to the POST /wp-json/corvuspay/success/ REST route at the WAF or web-server layer, allow-listing only CorvusPay's callback source IP ranges (side effect - legitimate payment confirmations from other networks will fail, so validate the gateway's egress addresses first); enforce true server-side signature verification so invalid signatures halt processing rather than merely log; and deploy a WAF rule to strip or reject script/HTML in the approval_code field. Review existing orders for already-stored malicious approval_code values, since patching does not retroactively clean poisoned records.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress/WooCommerce payment integration plugin (CPE cpe:2.3:a:corvusinfo:corvuspay_woocommerce_payment_gateway) that handles the CorvusPay hosted-payment callback. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the value returned by the payment processor's success callback (approval_code) is stored without sanitization and later rendered without output escaping, per the referenced source lines in class-wc-order-corvuspay.php (L185) and class-wc-gateway-corvuspay.php (L202, L1713). Compounding the sanitization gap is a broken authorization/trust-boundary design - the success REST endpoint is registered as public (__return_true) and its HMAC/signature validation is advisory only (it logs the outcome but does not return or die on failure), so the intended integrity control that would normally restrict this endpoint to the genuine payment gateway is effectively absent.
Know when Corvuspay Woocommerce Payment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Public unauthenticated REST endpoint (PR:N, AV:N, AC:L) with a bypassable signature check; stored XSS executing in another context yields S:C with limited C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.
Articles & Coverage 1
Executive ViewAI
The CorvusPay WooCommerce Payment Gateway plugin (all versions through 2.7.4) contains a stored cross-site scripting vulnerability that enables unauthenticated attackers to persistently inject malicious code into order records, exposing WordPress stores to customer data theft and administrative account compromise. This directly impacts any e-commerce operation using CorvusPay for payments, requiring urgent remediation to prevent data breach and credential harvesting.
Disable the plugin immediately until patch released. Deploy Web Application Firewall (WAF) rules targeting /wp-json/corvuspay/success/ to block JavaScript injection payloads. Restrict REST API access to authenticated users via authentication headers or IP allowlisting. Enable comprehensive audit logging for order modifications and REST API calls. Audit existing order records for injected code and remove malicious entries. Review administrator session logs for unauthorized access. Consider emergency migration to alternative payment gateway pending vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Unauthenticated order cancellation in CorvusPay WooCommerce Payment Gateway (all versions up to and including 2.7.4) all
Payment bypass in the CorvusPay WooCommerce Payment Gateway plugin (all versions up to and including 2.7.4) enables unau
Exploit-DB