EUVD-2026-42561
GHSA-pqfh-v7pq-gjhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WooCommerce store running CorvusPay plugin ≤2.7.4
-
DeliveryEnumerate sequential WooCommerce order IDs
-
ExploitSend unauthenticated HTTP request to /wp-json/corvuspay/cancel/ with target order ID
-
ExecutionPlugin processes cancellation without authorization check
-
PersistCorvusPay-paid order is cancelled
-
ImpactMerchant fulfillment disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the CorvusPay WooCommerce Payment Gateway plugin installed, active, and at version 2.7.4 or earlier, and that at least one order has been placed using the CorvusPay payment method. The WordPress REST API must be accessible over the network, which is default behavior for WordPress installations. No special conditions beyond plugin presence are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against any store with this plugin active. Exploitation is scoped to CorvusPay-method orders only; orders paid via other WooCommerce payment gateways are unaffected. Attackers must supply a numerically valid WooCommerce order ID, but WooCommerce uses predictable sequential integers, making enumeration trivial without any prior store knowledge. |
| Impact | The CVSS 5.3 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the technical characteristics: fully network-accessible, no complexity barrier, and no authentication required. However, the business impact for e-commerce operators may exceed what I:L implies - mass-cancellation of CorvusPay orders could cause measurable financial harm, fulfillment disruption, and customer trust erosion, particularly for smaller merchants reliant on this payment method. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC are present, suggesting no confirmed broad exploitation. The attack surface is constrained to stores that actively use CorvusPay as a payment method, reducing the overall affected population. This is a real operational priority for CorvusPay-integrated WooCommerce stores but a low priority for organizations not running this plugin. |
| Exploit ScenarioDerived | An attacker sends unauthenticated HTTP requests to the target WooCommerce store's /wp-json/corvuspay/cancel/ endpoint, iterating sequential integer order IDs. For each valid CorvusPay-paid order, the plugin processes the cancellation without verifying the requester's identity or ownership. The attacker can systematically cancel all pending CorvusPay orders on a merchant's store using nothing more than curl or a basic script, causing fulfillment disruption and potential financial loss with no exploit tooling required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Unauthenticated order cancellation in CorvusPay WooCommerce Payment Gateway (all versions up to and including 2.7.4) allows any remote attacker to cancel any WooCommerce order paid via CorvusPay by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST API endpoint. The plugin registers this cancel endpoint without implementing a WordPress permission callback, meaning no authorization is verified before processing cancellation requests (CWE-862). No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis, though the attack requires no credentials and minimal technical skill.
RemediationAI
Update the CorvusPay WooCommerce Payment Gateway plugin to a version beyond 2.7.4; a fix commit is available in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration, however the exact patched release version number is not independently confirmed in the available data - verify the current version in the WordPress plugin directory before updating. For stores unable to update immediately, restrict access to the /wp-json/corvuspay/cancel/ URI path via web server access controls (e.g., an nginx location deny block or Apache mod_rewrite rule) or a WAF policy rule; note this may interfere with legitimate payment gateway cancellation callbacks from CorvusPay's servers, so allowlisting CorvusPay IP ranges rather than blanket blocking is the preferred compensating control if those ranges are published by the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CorvusPay WooCommerce Payment Gateway (CPE: cpe:2.3:a:corvusinfo:corvuspay_woocommerce_payment_gateway:*:*:*:*:*:*:*:*) is a WordPress plugin integrating the CorvusPay payment processor into WooCommerce storefronts. WordPress REST API endpoints require explicit permission_callback functions to enforce access control; absent such a callback, endpoints default to public accessibility. The root cause is CWE-862 (Missing Authorization): the cancel endpoint registered at /wp-json/corvuspay/cancel/ lacks this callback, as evidenced by Wordfence source code references to class-wc-gateway-corvuspay.php lines 206 and 792 and class-wc-order-corvuspay.php line 172 in plugin versions 2.7.2 and 2.7.4. WooCommerce order IDs are sequential integers, making blind enumeration of cancellable orders trivially achievable without any prior knowledge.
Know when Corvuspay Woocommerce Payment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network-accessible REST endpoint with no auth check (AV:N, PR:N); impact is order cancellation only, no confidentiality or availability loss (C:N, A:N, I:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stored cross-site scripting in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (all versions through 2.7.
Payment bypass in the CorvusPay WooCommerce Payment Gateway plugin (all versions up to and including 2.7.4) enables unau
Exploit-DB