blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-91076

NOT SCORED
Published
October 14, 2026
Last modified
October 14, 2026
NVD status
Deferred
Reported by
contact@wpscan.com

Description

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Robokassa payment gateway for Woocommerce — Before 1.9.0

References

  • wpscan.com https://wpscan.com/vulnerability/9ba439de-33e3-4d79-b54a-8bf098e89f5f/
  • nvd.nist.gov Official NVD record