What is the CVSS score of CVE-2026-9027?

CVE-2026-9027 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

CorvusPay WooCommerce CVE-2026-9027

EUVD-2026-42560 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-09 Wordfence

GHSA-g5m6-f674-9758

WordPress Jwt Attack Authentication Bypass Corvuspay Woocommerce Payment Gateway

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated endpoint with trivial exploitation; Integrity is High because attackers can fraudulently complete financial transactions and obtain goods without payment.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:59 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

MEDIUM 5.3

DescriptionCVE.org

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The corvuspay_success_handler function registers the REST endpoint POST /wp-json/corvuspay/success/ with 'permission_callback' => '__return_true', and while it calls $this->client->validate->signature() and stores the boolean result in $res, the result is never evaluated in a conditional - it is only written to the debug log - causing execution to unconditionally reach $order->payment_complete() regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the order_number POST parameter, requiring no prior knowledge of the victim order.

AnalysisAI

Payment bypass in the CorvusPay WooCommerce Payment Gateway plugin (all versions up to and including 2.7.4) enables unauthenticated remote attackers to fraudulently mark any pending WooCommerce order as fully paid, obtaining goods or services without actual payment. The corvuspay_success_handler function registers a publicly accessible REST endpoint where a cryptographic signature validation is performed but its boolean result is silently discarded - written only to a debug log - causing $order->payment_complete() to execute unconditionally regardless of signature validity. WooCommerce order IDs are sequential integers, making every pending order on an affected store trivially enumerable with no prior knowledge required. No public exploit code or CISA KEV listing was identified at time of analysis.

Technical ContextAI

The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the plugin calls $this->client->validate->signature(), stores the result in $res, but never evaluates $res in a conditional branch. This is a dead-result bug - the security check runs but its output is effectively thrown away. The REST endpoint is registered with WordPress's 'permission_callback' => '__return_true', which grants public access to any unauthenticated caller by design, bypassing WordPress's built-in capability checking. The affected CPE is cpe:2.3:a:corvusinfo:corvuspay_woocommerce_payment_gateway:*:*:*:*:*:*:*:*. Source code references in the WordPress plugin repository confirm the flaw exists at class-wc-gateway-corvuspay.php:L656 and class-wc-order-corvuspay.php:L188 in both the 2.7.2 and 2.7.4 tagged releases. The tags indicate this has been categorized as both an Authentication Bypass and a JWT/signature attack, consistent with a payment gateway callback forgery.

RemediationAI

Upgrade the CorvusPay WooCommerce Payment Gateway plugin to a version beyond 2.7.4 immediately. An upstream fix commit is available in the WordPress plugin SVN repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration); however, a specific patched release version number was not independently confirmed from the provided data, so administrators should verify the latest available version in the WordPress plugin directory. As an immediate compensating control before patching, administrators should disable the CorvusPay payment gateway under WooCommerce > Settings > Payments - note this will also block all legitimate CorvusPay payment processing. Alternatively, deploying a WAF rule to block unauthenticated POST requests to the /wp-json/corvuspay/success/ endpoint from all source IPs except the known CorvusPay payment gateway server IP range will prevent exploitation while maintaining legitimate payment callbacks; this approach requires knowing CorvusPay's outbound IP ranges from their documentation. Review WooCommerce order history for anomalous payment_complete transitions on orders with no corresponding payment gateway confirmation as a detection measure.