CorvusPay WooCommerce EUVD-2026-39692

Exploitation requires only that a reachable WordPress site runs the CorvusPay WooCommerce Payment Gateway plugin at version 2.7.4 or earlier with its checkout/callback endpoints network-accessible - per AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special access needed against such an installation. The concrete prerequisite is presence and activation of the vulnerable plugin handling payment flows; the practical limiting factors are that the store must actually have this specific (relatively niche) gateway installed and the affected endpoint must be internet-reachable, which bounds the population of exploitable targets even though no per-target configuration toggle is required.

Signals are mixed and partly conflicting, which should temper prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, I:H) describes a network-reachable, low-complexity, unauthenticated integrity attack - a genuinely high-exposure profile that justifies the 7.5 base score. However, no EPSS probability is provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation; treat real-world risk as moderate and dependent on exposure of a vulnerable store. A notable inconsistency: Patchstack's tag labels this 'Information Disclosure,' yet the CVSS vector sets C:N and I:H - verify with the vendor whether the true impact is confidentiality or integrity, as this changes both detection and remediation focus. Net: a legitimate patch-soon issue for sites running this plugin, but not an emergency without exposure confirmation or exploitation signal.

An attacker who knows a target WooCommerce store uses the CorvusPay plugin sends a crafted unauthenticated HTTP request to the plugin's exposed payment/callback handler, exploiting the missing authentication check to alter trusted order or integration state - for example forging a successful-payment confirmation to obtain goods without paying. The attack requires only network access and low complexity (AV:N/AC:L/PR:N/UI:N) and no victim interaction; no public POC is currently identified, which modestly raises the effort to weaponize.