CorvusPay WooCommerce CVE-2026-9027

The target WordPress site must have the CorvusPay WooCommerce Payment Gateway plugin installed and active in a version up to and including 2.7.4, and the WooCommerce store must have at least one order in 'pending payment' status. No authentication is required - the REST endpoint is unconditionally public due to 'permission_callback' => '__return_true'. The attacker does not need any prior knowledge of specific order IDs because WooCommerce assigns them as sequential integers, making brute-force enumeration trivial starting from 1. Exploitation is limited to orders in pending status only; orders already in completed, cancelled, or failed states would not be affected. No specific non-default configuration is required - any store running the plugin version is vulnerable by default.

The official CVSS 3.1 score of 5.3 (Medium) with Integrity:Low significantly understates the real-world business impact of this vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly captures the trivial exploitation conditions - no authentication, no complexity, fully network-reachable - but classifying the integrity impact as Low fails to reflect that attackers can commit financial fraud by obtaining goods or services without payment, which constitutes a High integrity impact against the order management system. No EPSS score was provided, but the attack surface is large (any WordPress/WooCommerce store running this plugin) and the exploitation complexity is near-zero: a single crafted POST request suffices. No KEV listing is present, suggesting exploitation has not been confirmed widespread by CISA at time of analysis, but the attack requires no specialized tooling. The sequential order ID enumeration removes any obscurity barrier, making mass targeting of all pending orders on a store trivially automatable. Real-world priority is substantially higher than the raw CVSS score implies.

An attacker targeting a WooCommerce store with CorvusPay active sends automated POST requests to /wp-json/corvuspay/success/ iterating over sequential integer values for the order_number parameter and supplying a random or empty string as the signature value. Because the plugin discards the signature validation result, every request for a pending order triggers $order->payment_complete(), marking those orders as paid and initiating fulfillment. No POC code was identified in the provided data, but the attack requires nothing beyond standard HTTP tooling and the knowledge that the plugin is installed.