Unauthenticated Payment Notification Vulnerability in Robokassa Payment Gateway for WooCommerce
CVE-2026-91076
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 October 2026
Badges
What is CVE-2026-91076?
The Robokassa payment gateway for WooCommerce, prior to version 1.9.0, is susceptible to a malfunction due to improper verification of payment notification requests. This flaw enables unauthorized users to manipulate the state of any WooCommerce order, potentially leading to disruption in order fulfillment. Attackers can exploit this vulnerability to set order statuses to 'failed,' thereby circumventing normal transaction processes. Given the sequential nature of order identifiers, this issue could allow malicious actors to sequentially target multiple orders, effectively halting the entire fulfillment workflow.
Affected Version(s)
Robokassa payment gateway for Woocommerce 0 < 1.9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.