EUVD-2026-42561
GHSA-pqfh-v7pq-gjhm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network-accessible REST endpoint with no auth check (AV:N, PR:N); impact is order cancellation only, no confidentiality or availability loss (C:N, A:N, I:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
AnalysisAI
Unauthenticated order cancellation in CorvusPay WooCommerce Payment Gateway (all versions up to and including 2.7.4) allows any remote attacker to cancel any WooCommerce order paid via CorvusPay by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST API endpoint. The plugin registers this cancel endpoint without implementing a WordPress permission callback, meaning no authorization is verified before processing cancellation requests (CWE-862). No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis, though the attack requires no credentials and minimal technical skill.
Technical ContextAI
The CorvusPay WooCommerce Payment Gateway (CPE: cpe:2.3:a:corvusinfo:corvuspay_woocommerce_payment_gateway:*:*:*:*:*:*:*:*) is a WordPress plugin integrating the CorvusPay payment processor into WooCommerce storefronts. WordPress REST API endpoints require explicit permission_callback functions to enforce access control; absent such a callback, endpoints default to public accessibility. The root cause is CWE-862 (Missing Authorization): the cancel endpoint registered at /wp-json/corvuspay/cancel/ lacks this callback, as evidenced by Wordfence source code references to class-wc-gateway-corvuspay.php lines 206 and 792 and class-wc-order-corvuspay.php line 172 in plugin versions 2.7.2 and 2.7.4. WooCommerce order IDs are sequential integers, making blind enumeration of cancellable orders trivially achievable without any prior knowledge.
RemediationAI
Update the CorvusPay WooCommerce Payment Gateway plugin to a version beyond 2.7.4; a fix commit is available in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration, however the exact patched release version number is not independently confirmed in the available data - verify the current version in the WordPress plugin directory before updating. For stores unable to update immediately, restrict access to the /wp-json/corvuspay/cancel/ URI path via web server access controls (e.g., an nginx location deny block or Apache mod_rewrite rule) or a WAF policy rule; note this may interfere with legitimate payment gateway cancellation callbacks from CorvusPay's servers, so allowlisting CorvusPay IP ranges rather than blanket blocking is the preferred compensating control if those ranges are published by the vendor.
Stored cross-site scripting in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (all versions through 2.7.
Payment bypass in the CorvusPay WooCommerce Payment Gateway plugin (all versions up to and including 2.7.4) enables unau
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today