EUVD-2026-43161
GHSA-3qh5-q7jr-f3w8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Public unauthenticated REST endpoint (PR:N, AV:N, AC:L) with a bypassable signature check; stored XSS executing in another context yields S:C with limited C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (all versions through 2.7.4) lets unauthenticated attackers persist arbitrary JavaScript through the 'approval_code' parameter. The plugin exposes the REST route POST /wp-json/corvuspay/success/ with permission_callback set to __return_true, and its signature check only logs failures instead of blocking execution, so an attacker with any bogus signature can write a malicious approval_code into the order record, which then executes when a store operator or user views the affected page. Reported by Wordfence; no public exploit identified at time of analysis and no EPSS or KEV data provided.
Technical ContextAI
The affected component is a WordPress/WooCommerce payment integration plugin (CPE cpe:2.3:a:corvusinfo:corvuspay_woocommerce_payment_gateway) that handles the CorvusPay hosted-payment callback. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the value returned by the payment processor's success callback (approval_code) is stored without sanitization and later rendered without output escaping, per the referenced source lines in class-wc-order-corvuspay.php (L185) and class-wc-gateway-corvuspay.php (L202, L1713). Compounding the sanitization gap is a broken authorization/trust-boundary design - the success REST endpoint is registered as public (__return_true) and its HMAC/signature validation is advisory only (it logs the outcome but does not return or die on failure), so the intended integrity control that would normally restrict this endpoint to the genuine payment gateway is effectively absent.
RemediationAI
Upgrade to the latest release of the CorvusPay WooCommerce Payment Gateway plugin beyond 2.7.4; an upstream fix appears in the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration), but no exact fixed version number is stated in the available data, so confirm the patched version via the Wordfence advisory before deploying. If you cannot patch immediately, apply compensating controls: restrict or block external access to the POST /wp-json/corvuspay/success/ REST route at the WAF or web-server layer, allow-listing only CorvusPay's callback source IP ranges (side effect - legitimate payment confirmations from other networks will fail, so validate the gateway's egress addresses first); enforce true server-side signature verification so invalid signatures halt processing rather than merely log; and deploy a WAF rule to strip or reject script/HTML in the approval_code field. Review existing orders for already-stored malicious approval_code values, since patching does not retroactively clean poisoned records.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today