CVE-2026-91017CWE-345

CVE-2026-91017

Low · published September 17, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00136 · 2.8th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-09-17T11:16Z
References (1)
https://wpscan.com/vulnerability/1aeef0b4-9b14-4b03-b7f6-a05937622023/ · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 17 SEP 07:05Z
    Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
    cvelistv5