What is the CVSS score of CVE-2026-6939?

CVE-2026-6939 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of CorvusPay WooCommerce Gateway are affected by CVE-2026-6939?

The CorvusPay WooCommerce Payment Gateway plugin (all versions through 2.7.4) contains a stored cross-site scripting vulnerability that enables unauthenticated attackers to persistently inject…

How to fix or mitigate CVE-2026-6939?

Within 24 hours: Audit all WordPress instances for CorvusPay WooCommerce Payment Gateway; disable the plugin on affected systems immediately. Within 7 days: Review administrator access logs and order database for malicious 'approval_code' entries; deploy WAF rules blocking POST requests to /wp-json/corvuspay/success/ containing script tags or encoded payloads. Within 30 days: Restrict unauthenticated REST API access via .htaccess or firewall; evaluate replacement payment gateways; monitor vendor security advisory channels for patch release and apply to all systems when available.

CorvusPay WooCommerce Gateway CVE-2026-6939

EUVD-2026-43161 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-11 Wordfence

GHSA-3qh5-q7jr-f3w8

WordPress XSS Corvuspay Woocommerce Payment Gateway

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Public unauthenticated REST endpoint (PR:N, AV:N, AC:L) with a bypassable signature check; stored XSS executing in another context yields S:C with limited C:L/I:L and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:50 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

HIGH 7.2

DescriptionCVE.org

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Stored cross-site scripting in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (all versions through 2.7.4) lets unauthenticated attackers persist arbitrary JavaScript through the 'approval_code' parameter. The plugin exposes the REST route POST /wp-json/corvuspay/success/ with permission_callback set to __return_true, and its signature check only logs failures instead of blocking execution, so an attacker with any bogus signature can write a malicious approval_code into the order record, which then executes when a store operator or user views the affected page. Reported by Wordfence; no public exploit identified at time of analysis and no EPSS or KEV data provided.

Technical ContextAI

The affected component is a WordPress/WooCommerce payment integration plugin (CPE cpe:2.3:a:corvusinfo:corvuspay_woocommerce_payment_gateway) that handles the CorvusPay hosted-payment callback. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the value returned by the payment processor's success callback (approval_code) is stored without sanitization and later rendered without output escaping, per the referenced source lines in class-wc-order-corvuspay.php (L185) and class-wc-gateway-corvuspay.php (L202, L1713). Compounding the sanitization gap is a broken authorization/trust-boundary design - the success REST endpoint is registered as public (__return_true) and its HMAC/signature validation is advisory only (it logs the outcome but does not return or die on failure), so the intended integrity control that would normally restrict this endpoint to the genuine payment gateway is effectively absent.

RemediationAI

Upgrade to the latest release of the CorvusPay WooCommerce Payment Gateway plugin beyond 2.7.4; an upstream fix appears in the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration), but no exact fixed version number is stated in the available data, so confirm the patched version via the Wordfence advisory before deploying. If you cannot patch immediately, apply compensating controls: restrict or block external access to the POST /wp-json/corvuspay/success/ REST route at the WAF or web-server layer, allow-listing only CorvusPay's callback source IP ranges (side effect - legitimate payment confirmations from other networks will fail, so validate the gateway's egress addresses first); enforce true server-side signature verification so invalid signatures halt processing rather than merely log; and deploy a WAF rule to strip or reject script/HTML in the approval_code field. Review existing orders for already-stored malicious approval_code values, since patching does not retroactively clean poisoned records.