WP-Safety
CVE-2026-9028

CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter

mediumMissing Authorization
5.3
CVSS Score
5.3
CVSS Score
medium
Severity
2.7.5
Patched in
1d
Time to patch

Description

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.7.4
PublishedJuly 8, 2026
Last updatedJuly 9, 2026
Affected plugincorvuspay-woocommerce-integration

What Changed in the Fix

Changes introduced in v2.7.5

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v2.7.4
Browse source Download .zip
Patched v2.7.5
Browse source Download .zip
Research Plan
Unverified

# Research Plan: CVE-2026-9028 CorvusPay WooCommerce Arbitrary Order Cancellation ## 1. Vulnerability Summary The **CorvusPay WooCommerce Payment Gateway** plugin (<= 2.7.4) is vulnerable to an authorization bypass via its REST API. The plugin registers a REST endpoint designed to handle order canc…

Show full research plan

Research Plan: CVE-2026-9028 CorvusPay WooCommerce Arbitrary Order Cancellation

1. Vulnerability Summary

The CorvusPay WooCommerce Payment Gateway plugin (<= 2.7.4) is vulnerable to an authorization bypass via its REST API. The plugin registers a REST endpoint designed to handle order cancellations (likely for payment provider callbacks), but it fails to implement a permission_callback to restrict access or a signature/secret verification mechanism to validate that the request originated from CorvusPay. Consequently, any unauthenticated user can cancel any WooCommerce order by simply providing the order_number.

2. Attack Vector Analysis

  • Endpoint: /wp-json/corvuspay/cancel/ (Namespace: corvuspay, Route: /cancel/)
  • HTTP Method: Likely POST or GET (Common for payment callbacks).
  • Vulnerable Parameter: order_number
  • Authentication: None (Unauthenticated).
  • Preconditions: At least one WooCommerce order must exist that was initiated (but not necessarily completed) via the CorvusPay payment method.

3. Code Flow

  1. Route Registration: In includes/class-wc-gateway-corvuspay.php, the function register_corvuspay_rest_routes (hooked to rest_api_init) registers the route /corvuspay/cancel/.
  2. Missing Permission Check: The registration likely uses 'permission_callback' => '__return_true' or omits it entirely, allowing public access.
  3. Order Retrieval: The callback function (e.g., corvuspay_cancel_rest_handler) extracts the order_number from the request.
  4. Order Mapping: The plugin uses WC_Order_CorvusPay::get_post_by_corvuspay_order_number (found in includes/class-wc-order-corvuspay.php) to resolve the CorvusPay order_number to a WordPress Post ID.
  5. State Change: The logic calls $order->update_status( 'cancelled', ... ) without verifying if the current request is authorized or cryptographically signed.

4. Nonce Acquisition Strategy

According to the vulnerability description, this is an unauthenticated bypass on a REST endpoint.

  • REST API Nonces: Typically, WordPress REST API requires a X-WP-Nonce header for cookie-authenticated sessions. However, endpoints intended for external webhooks (like payment gateways) are usually registered with 'permission_callback' => '__return_true' and do not enforce nonce checks for unauthenticated requests.
  • Bypass: If the endpoint is correctly identified as a webhook receiver, no nonce is required.

5. Exploitation Strategy

Step 1: Discover REST Route

Verify the exact REST route registered by the plugin.

wp rest route list --prefix=corvuspay

Step 2: Create a Target Order

Create a WooCommerce order to cancel.

# Create a customer user
wp user create victim victim@example.com --role=customer

# Create a product
wp post create --post_type=product --post_title="Test Product" --post_status=publish

# Create an order for the victim
# Note: In a real scenario, the order would be set to 'corvuspay' payment method
wp wc order create --customer_id=$(wp user get victim --field=ID) --status=pending --user=victim --payment_method=corvuspay

Step 3: Determine the CorvusPay Order Number

The plugin might format the order_number with a delimiter (see WC_Order_CorvusPay::ORDER_NUMBER_DELIMITER = ' - '). Use WP-CLI to see how the metadata is stored for the order.

# Check the metadata for the created order (e.g., ID 123)
wp post meta list 123

Look for _corvuspay_order_number. If it doesn't exist, the exploit might use the raw Order ID.

Step 4: Execute Cancellation Request

Send a request to the REST endpoint. We will try both GET and POST as the exact method is inferred.

Using POST (Likely):

# Example for Order ID 123
http_request POST "http://localhost:8080/wp-json/corvuspay/cancel/" \
  --data '{"order_number": "123"}' \
  --header "Content-Type: application/json"

Using GET (Alternative):

http_request GET "http://localhost:8080/wp-json/corvuspay/cancel/?order_number=123"

6. Test Data Setup

  1. WooCommerce installed and active.
  2. CorvusPay plugin installed and active.
  3. One "Pending Payment" order created via the CorvusPay gateway.
  4. Record the Order ID (e.g., 123).

7. Expected Results

  • The HTTP response should indicate success (e.g., 200 OK or a JSON success message).
  • The order status in WooCommerce must change from pending (or processing) to cancelled.

8. Verification Steps

After sending the HTTP request, verify the state change via WP-CLI:

# Check the status of the target order
wp wc order get 123 --field=status

Success Criteria: The output is cancelled.

9. Alternative Approaches

If the simple ID fails:

  • Prefix Guessing: If the site is in "Test Mode", the order_number might be prefixed. Check includes/class-wc-order-corvuspay.php for prefixing logic.
  • Legacy Endpoint: The plugin also registers woocommerce_api_corvuspay-cancel. If the REST API is restricted, try the legacy WC API:
    http://localhost:8080/?wc-api=corvuspay-cancel&order_number=123
  • Data Format: If JSON fails, try standard application/x-www-form-urlencoded POST data.
Research Findings
Static analysis — not yet PoC-verified

Summary

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to an authorization bypass due to missing signature or permission checks on its cancellation endpoints. This allows unauthenticated attackers to cancel any WooCommerce order placed via CorvusPay by providing an arbitrary order number to the REST API or legacy callback hooks.

Vulnerable Code

// includes/class-wc-gateway-corvuspay.php line 233
add_action( 'woocommerce_api_corvuspay-cancel', array( $this, 'corvuspay_cancel_handler' ) );
add_action( 'rest_api_init', array( $this, 'register_corvuspay_rest_routes' ) );

---

// includes/class-wc-order-corvuspay.php line 147
} elseif ( 'callback' === $type || 'callback-signed' === $type ) {
    /* Existing order from POST */
    if ( ! is_null( $order ) ) {
        throw new Exception( 'WC_Order_CorvusPay expects $order to be null when $type is set to \'cardholder\'.' );
    }

    /* Create CorvusPay Client */
    $config_params = ['store_id' => $this->get_store_id(), 'secret_key' => $this->get_secret_key(),
                      'environment' => $this->options->environment, 'logger' => $this->log, 'version' => '1.4'];
    $this->client = new CorvusPay\CorvusPayClient( $config_params );

    // TODO add filter
    $this->parameters = filter_input_array( INPUT_POST );

    $post_id = $this->get_post_by_corvuspay_order_number( $this->parameters['order_number'] );

    if ( null === $post_id ) {
        $this->log->error( 'The parameter $post_id is null. There is no post with 
        _corvuspay_order_number equals ' . $this->parameters['order_number'] );
    }

    parent::__construct( $post_id );
    
    if ( 'callback-signed' === $type ) {
        if ( isset( $this->parameters["approval_code"] ) && $this->parameters["approval_code"] != null ) {
            $this->update_meta_data( '_corvuspay_approval_code', $this->parameters["approval_code"] );
            $this->update_meta_data( '_corvuspay_transaction_date', current_time( "d.m.Y H:i:s" ) );
        }
        $res = $this->client->validate->signature( $this->parameters );
        $this->log->debug( 'Result from signature validation: ' . $res );
    }

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/assets/img/cards/dina.svg /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/assets/img/cards/dina.svg
--- /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/assets/img/cards/dina.svg	2019-03-20 12:19:56.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/assets/img/cards/dina.svg	2026-06-18 09:41:54.000000000 +0000
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 150 93.75"><defs><style>.cls-1{fill:#f9f9f9;}.cls-2{fill:#0054a5;}.cls-2,.cls-3{fill-rule:evenodd;}.cls-3{fill:#ec1c24;}</style></defs><title>dina</title><g id="Layer_2" data-name="Layer 2"><g id="Layer_1-2" data-name="Layer 1"><rect class="cls-1" width="150" height="93.75" rx="5"/><path class="cls-2" d="M22.43,49.44h1.51a4.83,4.83,0,0,0,2.91-.67,2.75,2.75,0,0,0,.85-2.24,2.82,2.82,0,0,0-.85-2.3A4.42,4.42,0,0,0,24,43.57H22.43v5.87Zm-5.69,3V40.54h6.84a34.63,34.63,0,0,1,3.94.12,9,9,0,0,1,2.17.55,5.83,5.83,0,0,1,2.79,2,5.73,5.73,0,0,1,.91,3.27,5.27,5.27,0,0,1-1.15,3.39A6.89,6.89,0,0,1,28.85,52a9.59,9.59,0,0,1-2.12.37c-.91.06-2.24.12-4.18.12Zm18.71-9.69V40.24h5.2v2.54Zm0,9.69V43.63h5.2v8.84Zm7.75,0V43.63h4.72V45a5.38,5.38,0,0,1,2-1.15,8.62,8.62,0,0,1,2.54-.36,7.63,7.63,0,0,1,2.12.24,3.86,3.86,0,0,1,1.57.78A2.74,2.74,0,0,1,57,45.69a6.51,6.51,0,0,1,.24,2.17v4.61H52.1V47.86a1.59,1.59,0,0,0-.43-1.33,1.94,1.94,0,0,0-1.33-.36,2.25,2.25,0,0,0-1.51.42,1.61,1.61,0,0,0-.43,1.27v4.61Zm25.12-3.94c-.48.12-1.15.24-1.94.36-1.33.25-1.93.55-1.93,1a.73.73,0,0,0,.36.61,2.56,2.56,0,0,0,1.09.18,3.11,3.11,0,0,0,1.88-.42,1.34,1.34,0,0,0,.6-1.28v-.3c0-.06,0-.12-.06-.12Zm.49,3.94-.31-.85a9.49,9.49,0,0,1-2.12.85,8.81,8.81,0,0,1-2.6.3A6.91,6.91,0,0,1,60.33,52,2.29,2.29,0,0,1,59.18,50a2.08,2.08,0,0,1,1.15-2,16.49,16.49,0,0,1,4.48-.91c.3,0,.67-.06,1.15-.06,1.64-.06,2.42-.37,2.42-.79a.6.6,0,0,0-.42-.61,4.6,4.6,0,0,0-1.45-.12,3.16,3.16,0,0,0-1.21.19.79.79,0,0,0-.49.66H59.72a2.63,2.63,0,0,1,1.82-2.24,12.82,12.82,0,0,1,5.15-.79,14.34,14.34,0,0,1,3,.25,7.09,7.09,0,0,1,2.12.54,3.47,3.47,0,0,1,1.34.91,2.9,2.9,0,0,1,.36,1.57v4.85a.87.87,0,0,0,.12.42,1.22,1.22,0,0,0,.42.36v.25ZM87.7,47.8H93a4.65,4.65,0,0,1-2.42,3.7,11.88,11.88,0,0,1-6,1.27A11.16,11.16,0,0,1,78,51.07a5.14,5.14,0,0,1-2.36-4.54,5.44,5.44,0,0,1,2.3-4.66,11.67,11.67,0,0,1,6.6-1.69,11.88,11.88,0,0,1,6,1.27A4.68,4.68,0,0,1,93,45.08H87.51a1.7,1.7,0,0,0-.84-1.39,4,4,0,0,0-2.12-.49,3,3,0,0,0-3.33,3.33A3.33,3.33,0,0,0,82.07,49a3.8,3.8,0,0,0,2.6.85,3.7,3.7,0,0,0,2.12-.54,2.21,2.21,0,0,0,.91-1.46Zm15.86.73c-.49.12-1.15.24-2,.36-1.27.25-1.94.55-1.94,1,0,.25.12.43.43.61a2.53,2.53,0,0,0,1.09.18,3.18,3.18,0,0,0,1.87-.42,1.45,1.45,0,0,0,.61-1.28.45.45,0,0,0-.06-.3v-.12Zm.48,3.94-.3-.85a9.07,9.07,0,0,1-2.18.85,8.85,8.85,0,0,1-2.6.3A6.47,6.47,0,0,1,95.57,52,2.35,2.35,0,0,1,94.36,50a2.13,2.13,0,0,1,1.21-2,16.4,16.4,0,0,1,4.48-.91c.24,0,.66-.06,1.09-.06,1.63-.06,2.48-.37,2.48-.79a.68.68,0,0,0-.42-.61,4.67,4.67,0,0,0-1.46-.12,2.81,2.81,0,0,0-1.21.19.86.86,0,0,0-.54.66H95a2.45,2.45,0,0,1,1.82-2.24,12.57,12.57,0,0,1,5.14-.79,14.5,14.5,0,0,1,3,.25,7.09,7.09,0,0,1,2.12.54,3.08,3.08,0,0,1,1.27.91,2.89,2.89,0,0,1,.37,1.57v4.85a.54.54,0,0,0,.18.42c.06.18.24.24.42.36v.25Zm7.27,0V43.63h4.78v1.63a3,3,0,0,1,1.46-1.39,6.22,6.22,0,0,1,2.54-.42h.48V47a1.66,1.66,0,0,0-.54-.06h-.49a4.47,4.47,0,0,0-2.3.42,1.55,1.55,0,0,0-.78,1.51v3.64Zm24.58,0h-4.6V51.38a5,5,0,0,1-1.88,1,7.55,7.55,0,0,1-2.42.36,6.09,6.09,0,0,1-4-1.27,4.26,4.26,0,0,1-1.57-3.45A4.16,4.16,0,0,1,123,44.72a5.82,5.82,0,0,1,4-1.34,7.86,7.86,0,0,1,2.12.31,4.49,4.49,0,0,1,1.69.91V40.54h5.09V52.47Zm-7.14-2.3a2.27,2.27,0,0,0,1.57-.55,2,2,0,0,0,.54-1.51,1.82,1.82,0,0,0-.54-1.46,2.57,2.57,0,0,0-3.15,0,1.82,1.82,0,0,0-.54,1.46,2,2,0,0,0,.54,1.51,2.18,2.18,0,0,0,1.58.55Z"/><path class="cls-2" d="M45,72.63h61.88a25.77,25.77,0,0,0,23.85-16h-2.9a23,23,0,0,1-21,13.44H45A23.09,23.09,0,0,1,24,56.58H21.16A25.69,25.69,0,0,0,45,72.63Zm85.73-35.18a25.77,25.77,0,0,0-23.85-16H45a25.69,25.69,0,0,0-23.79,16H24A23.09,23.09,0,0,1,45,24h61.88a23,23,0,0,1,21,13.44Z"/><path class="cls-3" d="M76.13,14.26a32.83,32.83,0,0,1,31.24,23.19H44.77A32.87,32.87,0,0,1,76.13,14.26Zm31.24,42.32a32.72,32.72,0,0,1-62.6,0Z"/></g></g></svg>
\ No newline at end of file
+<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 150 93.75" width="150" height="93.75" preserveAspectRatio="xMidYMid meet"><defs><style>.cls-1{fill:#f9f9f9;}</style></defs><title>DinaCard</title><rect class="cls-1" width="150" height="93.75" rx="5"/><g transform="translate(4 20.42735811350919) scale(0.1135091926458833) translate(-296 -390)"> <g id="group-MC0"><path   id="path2"   d="m 0,0 c 3.426,-2.195 8.344,-3.864 13.613,-3.864 7.818,0 12.384,4.128 12.384,10.1 0,5.446 -3.161,8.696 -11.154,11.682 -9.661,3.513 -15.634,8.606 -15.634,16.863 0,9.222 7.642,16.073 19.147,16.073 5.973,0 10.452,-1.406 12.999,-2.899 L 29.247,41.72 c -1.845,1.141 -5.797,2.81 -11.154,2.81 -8.08,0 -11.155,-4.831 -11.155,-8.871 0,-5.533 3.601,-8.256 11.77,-11.418 10.013,-3.864 15.019,-8.695 15.019,-17.39 0,-9.134 -6.675,-17.126 -20.64,-17.126 -5.709,0 -11.945,1.755 -15.108,3.864 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1225.9172,786.90373)" /><path   id="path3"   d="M 0,0 C 0.088,4.83 -2.02,12.472 -10.715,12.472 -18.62,12.472 -21.957,5.357 -22.572,0 Z m -22.66,-5.533 c 0.176,-10.452 6.764,-14.756 14.58,-14.756 5.533,0 8.959,0.967 11.769,2.196 l 1.406,-5.533 c -2.723,-1.229 -7.466,-2.723 -14.229,-2.723 -13.087,0 -20.903,8.695 -20.903,21.518 0,12.823 7.553,22.836 19.936,22.836 13.965,0 17.567,-12.12 17.567,-19.938 0,-1.581 -0.088,-2.722 -0.264,-3.6 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1321.2415,765.4728)" /><path   id="path4"   d="m 0,0 c -2.021,-0.966 -6.5,-2.459 -12.208,-2.459 -12.823,0 -21.167,8.694 -21.167,21.693 0,13.087 8.958,22.661 22.835,22.661 4.567,0 8.607,-1.142 10.716,-2.284 l -1.757,-5.884 c -1.845,0.965 -4.743,2.02 -8.959,2.02 -9.749,0 -15.019,-7.29 -15.019,-16.073 0,-9.837 6.325,-15.898 14.756,-15.898 4.391,0 7.289,1.055 9.486,2.021 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1384.3625,797.3256)" /><path   id="path5"   d="m 0,0 c 0,-4.479 0.088,-8.344 0.352,-11.682 h -6.851 l -0.439,6.939 h -0.176 c -1.932,-3.425 -6.499,-7.904 -14.053,-7.904 -6.675,0 -14.667,3.776 -14.667,18.619 v 24.856 h 7.729 V 7.377 c 0,-8.08 2.546,-13.613 9.485,-13.613 5.182,0 8.783,3.601 10.188,7.114 0.44,1.054 0.703,2.459 0.703,3.952 V 30.828 H 0 Z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1443.8533,783.74107)" /><path   id="path6"   d="M 0,0 C 0,5.007 -0.088,9.311 -0.351,13.263 H 6.412 L 6.764,4.831 h 0.262 c 1.933,5.709 6.676,9.31 11.858,9.31 0.79,0 1.405,-0.088 2.108,-0.176 V 6.675 C 20.201,6.851 19.411,6.851 18.356,6.851 12.911,6.851 9.047,2.811 7.993,-2.986 7.817,-4.04 7.729,-5.357 7.729,-6.587 v -22.66 H 0 Z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1460.9511,760.3204)"/><path   id="path7"   d="M 0,0 C 0.088,4.83 -2.02,12.472 -10.715,12.472 -18.619,12.472 -21.957,5.357 -22.572,0 Z m -22.66,-5.533 c 0.176,-10.452 6.764,-14.756 14.58,-14.756 5.533,0 8.959,0.967 11.769,2.196 l 1.406,-5.533 c -2.723,-1.229 -7.466,-2.723 -14.229,-2.723 -13.087,0 -20.903,8.695 -20.903,21.518 0,12.823 7.553,22.836 19.936,22.836 13.966,0 17.567,-12.12 17.567,-19.938 0,-1.581 -0.088,-2.722 -0.264,-3.6 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1534.0265,765.4728)" /><path   id="path8"   d="m 0,0 c -23.104,48.986 -71.894,78.522 -127.259,78.522 -70.137,0 -135.309,-47.11 -158.324,-112.163 27.325,79.541 101.25,132.979 180.812,132.979 62.798,0 118.141,-33.504 145.842,-88.564 L 30.7,-5.514 Z m -19.645,-124.063 c 3.692,3.366 6.271,7.356 7.736,11.97 1.467,4.614 2.633,8.983 3.502,13.109 l 7.329,32.244 c 0.867,3.474 1.411,6.162 1.627,8.06 0.218,1.901 0.325,3.339 0.325,4.317 0,0.976 -0.242,2.198 -0.732,3.663 -0.488,1.466 -1.711,3.122 -3.663,4.967 h 23.613 c 2.279,0 4.449,0.272 6.512,0.814 2.064,0.544 4.182,1.357 6.352,2.442 l -3.747,-16.609 c 1.088,1.845 2.443,3.718 4.074,5.619 1.627,1.898 3.474,3.609 5.535,5.129 2.063,1.519 4.343,2.74 6.84,3.664 2.496,0.922 5.212,1.33 8.144,1.222 l 3.745,-0.164 -5.376,-24.427 c -1.845,1.521 -3.58,2.497 -5.212,2.931 -1.626,0.434 -2.875,0.652 -3.744,0.652 -3.148,0 -5.943,-0.76 -8.386,-2.28 -2.443,-1.519 -4.423,-3.42 -5.945,-5.699 -0.867,-1.195 -1.627,-2.58 -2.28,-4.154 -0.65,-1.573 -1.248,-3.175 -1.79,-4.803 -0.543,-1.629 -1.004,-3.122 -1.384,-4.478 -0.38,-1.357 -0.625,-2.416 -0.734,-3.176 l -2.115,-9.934 c -0.219,-0.977 -0.463,-2.144 -0.734,-3.501 -0.271,-1.357 -0.544,-2.823 -0.814,-4.397 -0.271,-1.575 -0.515,-3.094 -0.734,-4.56 -0.216,-1.465 -0.325,-2.741 -0.325,-3.826 0,-2.389 0.325,-4.29 0.976,-5.7 0.652,-1.411 1.249,-2.443 1.792,-3.095 z m -535.445,16.936 c 1.52,-0.542 3.121,-0.95 4.804,-1.221 1.683,-0.271 3.284,-0.406 4.804,-0.406 3.908,0 8.033,1.085 12.376,3.256 4.343,2.171 8.36,5.619 12.052,10.34 3.691,4.722 6.757,10.749 9.201,18.077 2.443,7.327 3.663,16.149 3.663,26.463 0,6.622 -0.895,11.752 -2.686,15.389 -1.792,3.636 -3.909,6.297 -6.352,7.979 -2.443,1.683 -4.939,2.688 -7.491,3.013 -2.551,0.325 -4.532,0.488 -5.944,0.488 -1.194,0 -2.089,-0.026 -2.687,-0.08 -0.598,-0.055 -1.71,-0.299 -3.338,-0.733 z m -42.83,-16.936 c 2.39,1.737 4.343,3.528 5.863,5.374 1.521,1.846 2.769,3.828 3.746,5.945 0.977,2.116 1.764,4.315 2.361,6.595 0.598,2.28 1.167,4.668 1.711,7.165 l 14.167,63.837 c 1.085,4.776 1.71,8.196 1.872,10.259 0.163,2.062 0.245,3.419 0.245,4.07 0,1.521 -0.299,3.149 -0.895,4.886 -0.597,1.737 -1.873,3.691 -3.827,5.862 h 49.831 c 6.621,0 12.511,-0.515 17.668,-1.546 5.158,-1.031 9.853,-2.959 14.088,-5.78 5.753,-3.91 9.88,-9.066 12.375,-15.472 2.498,-6.406 3.746,-13.625 3.746,-21.658 0,-5.645 -0.624,-11.265 -1.873,-16.855 -1.247,-5.592 -3.039,-10.912 -5.373,-15.959 -2.334,-5.05 -5.266,-9.771 -8.794,-14.168 -3.529,-4.397 -7.573,-8.225 -12.132,-11.481 -5.646,-4.016 -11.888,-6.867 -18.729,-8.549 -6.839,-1.683 -15.252,-2.525 -25.24,-2.525 z m 162.198,118.228 c 4.559,0 8.196,-1.329 10.911,-3.99 2.714,-2.659 4.071,-6.269 4.071,-10.829 0,-5.32 -1.628,-9.662 -4.885,-13.028 -3.258,-3.366 -7.383,-5.048 -12.376,-5.048 -4.887,0 -8.741,1.438 -11.563,4.315 -2.823,2.877 -4.235,6.595 -4.235,11.156 0,5.211 1.629,9.417 4.887,12.62 3.256,3.203 7.653,4.804 13.19,4.804 m -5.7,-39.898 c 4.234,0 7.573,0.407 10.015,1.222 2.444,0.814 4.261,1.492 5.455,2.034 l -12.213,-55.367 c -0.218,-0.76 -0.461,-1.845 -0.733,-3.258 -0.271,-1.41 -0.407,-2.659 -0.407,-3.744 0,-1.195 0.217,-2.091 0.652,-2.688 0.433,-0.596 0.95,-1.058 1.547,-1.384 0.597,-0.326 1.194,-0.516 1.79,-0.57 0.598,-0.054 1.114,-0.082 1.547,-0.082 1.738,0 3.096,0.164 4.072,0.489 0.978,0.327 1.737,0.597 2.28,0.815 l -11.563,-14.82 c -3.147,-1.52 -5.916,-2.442 -8.304,-2.768 -2.389,-0.326 -4.506,-0.488 -6.351,-0.488 -1.521,0 -3.176,0.162 -4.967,0.488 -1.792,0.326 -3.448,1.033 -4.967,2.118 -1.52,1.085 -2.795,2.633 -3.828,4.64 -1.03,2.009 -1.546,4.695 -1.546,8.061 0,2.496 0.217,4.723 0.651,6.677 0.434,1.955 0.924,4.125 1.466,6.514 l 6.84,31.104 c 0.108,0.652 0.27,1.465 0.488,2.443 0.217,0.978 0.435,2.063 0.652,3.257 0.217,1.193 0.406,2.36 0.569,3.501 0.163,1.14 0.245,2.198 0.245,3.176 0,2.171 -0.543,3.989 -1.629,5.454 -1.085,1.466 -1.954,2.524 -2.606,3.176 z m 14.819,-78.33 c 3.69,3.366 6.269,7.356 7.736,11.97 1.465,4.614 2.632,8.983 3.5,13.109 l 7.33,32.244 c 0.867,3.474 1.41,6.162 1.627,8.06 0.217,1.901 0.327,3.339 0.327,4.317 0,0.976 -0.245,2.198 -0.734,3.663 -0.489,1.466 -1.71,3.122 -3.664,4.967 h 23.613 c 2.281,0 4.451,0.272 6.514,0.814 2.063,0.544 4.18,1.357 6.351,2.442 l -2.932,-12.701 c 2.498,2.823 4.968,5.02 7.41,6.596 2.443,1.573 4.723,2.741 6.841,3.501 2.116,0.759 3.962,1.221 5.536,1.384 1.574,0.163 2.795,0.245 3.664,0.245 3.039,0 5.891,-0.462 8.55,-1.385 2.659,-0.922 4.993,-2.253 7.002,-3.99 2.009,-1.738 3.583,-3.772 4.722,-6.106 1.141,-2.336 1.71,-4.968 1.71,-7.898 0,-0.87 -0.081,-2.255 -0.243,-4.153 -0.163,-1.901 -0.679,-4.696 -1.549,-8.386 l -4.885,-22.311 c -0.542,-2.063 -0.84,-3.61 -0.895,-4.641 -0.053,-1.032 -0.082,-1.711 -0.082,-2.036 0,-1.087 0.3,-2.225 0.897,-3.42 0.597,-1.194 2.034,-1.792 4.315,-1.792 1.303,0 2.688,0.164 4.151,0.489 1.467,0.327 2.634,0.652 3.503,0.978 l -11.563,-14.983 c -1.736,-0.868 -3.746,-1.629 -6.025,-2.279 -2.28,-0.652 -4.995,-0.977 -8.143,-0.977 -3.581,0 -6.513,0.515 -8.793,1.547 -2.28,1.031 -4.071,2.306 -5.374,3.827 -1.303,1.519 -2.199,3.229 -2.688,5.129 -0.487,1.9 -0.732,3.664 -0.732,5.293 0,1.845 0.218,3.609 0.651,5.292 0.435,1.684 0.923,3.664 1.466,5.943 l 5.7,25.08 c 0.217,0.543 0.38,1.195 0.488,1.954 0.11,0.759 0.163,1.465 0.163,2.117 0,1.846 -0.299,3.258 -0.895,4.235 -0.598,0.976 -1.277,1.709 -2.035,2.197 -0.761,0.489 -1.548,0.788 -2.363,0.897 -0.813,0.107 -1.438,0.162 -1.872,0.162 -4.343,0 -7.518,-1.655 -9.527,-4.967 -2.008,-3.311 -3.61,-7.734 -4.803,-13.272 l -3.746,-18.076 c -0.218,-0.977 -0.462,-2.144 -0.734,-3.501 -0.27,-1.357 -0.542,-2.823 -0.813,-4.397 -0.272,-1.575 -0.516,-3.094 -0.733,-4.56 -0.218,-1.465 -0.326,-2.741 -0.326,-3.826 0,-2.389 0.326,-4.29 0.976,-5.7 0.653,-1.411 1.249,-2.443 1.793,-3.095 z m 146.564,-0.814 c -1.194,-0.326 -2.579,-0.651 -4.153,-0.977 -1.574,-0.326 -3.446,-0.488 -5.617,-0.488 -3.583,0 -7.058,0.542 -10.422,1.627 -3.367,1.085 -6.379,2.769 -9.04,5.049 -2.66,2.28 -4.777,5.265 -6.35,8.958 -1.575,3.69 -2.362,8.142 -2.362,13.352 0,3.257 0.325,6.677 0.977,10.26 0.652,3.582 1.683,7.166 3.095,10.747 1.41,3.583 3.284,7.085 5.618,10.504 2.335,3.421 5.13,6.595 8.387,9.527 1.954,1.737 4.097,3.393 6.432,4.966 2.335,1.574 4.994,2.933 7.98,4.072 2.986,1.14 6.297,2.064 9.933,2.769 3.637,0.706 7.735,1.059 12.295,1.059 2.281,0 4.425,-0.11 6.432,-0.327 2.009,-0.217 3.936,-0.434 5.783,-0.652 2.278,-0.216 4.287,-0.433 6.024,-0.65 1.736,-0.217 3.473,-0.326 5.211,-0.326 2.172,0 4.506,0.191 7.003,0.57 2.497,0.379 5.156,1.331 7.979,2.85 l -12.213,-55.694 c -0.218,-0.978 -0.461,-2.063 -0.733,-3.257 -0.27,-1.195 -0.407,-2.389 -0.407,-3.583 0,-1.412 0.38,-2.606 1.14,-3.582 0.76,-0.978 2.226,-1.467 4.397,-1.467 1.193,0 2.443,0.136 3.745,0.408 1.304,0.271 2.552,0.623 3.746,1.059 l -11.563,-14.983 c -2.497,-1.302 -4.912,-2.171 -7.246,-2.604 -2.334,-0.435 -4.588,-0.652 -6.758,-0.652 -1.194,0 -2.795,0.108 -4.804,0.325 -2.009,0.217 -3.964,0.869 -5.862,1.954 -1.901,1.086 -3.529,2.742 -4.887,4.967 -1.357,2.226 -2.036,5.347 -2.036,9.363 0,0.761 0.056,1.467 0.164,2.118 0.108,0.651 0.245,1.412 0.407,2.281 0.163,0.867 0.38,1.899 0.651,3.094 0.272,1.193 0.624,2.713 1.059,4.559 l 8.305,36.966 c -0.869,0.544 -2.008,1.114 -3.42,1.71 -1.412,0.597 -2.931,0.895 -4.56,0.895 -2.93,0 -5.754,-1.166 -8.467,-3.501 -2.715,-2.334 -5.076,-5.319 -7.085,-8.955 -2.008,-3.637 -3.609,-7.709 -4.804,-12.215 -1.194,-4.505 -1.79,-8.93 -1.79,-13.272 0,-5.102 1.357,-8.766 4.071,-10.992 2.713,-2.226 5.916,-3.338 9.608,-3.338 0.543,0 1.004,0.027 1.383,0.082 0.38,0.053 0.734,0.134 1.059,0.243 z"   style="fill:#c5161d;fill-opacity:1;fill-rule:evenodd;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1093.4381,523.22053)" /><path   id="path9"   d="m 0,0 c -1.194,-0.325 -2.579,-0.651 -4.155,-0.977 -1.572,-0.325 -3.445,-0.488 -5.618,-0.488 -3.583,0 -7.056,0.543 -10.421,1.628 -3.367,1.085 -6.379,2.768 -9.039,5.049 -2.659,2.279 -4.777,5.265 -6.351,8.957 -1.574,3.691 -2.36,8.143 -2.36,13.353 0,3.256 0.325,6.676 0.976,10.259 0.653,3.582 1.683,7.166 3.096,10.748 1.41,3.583 3.284,7.085 5.618,10.504 2.333,3.42 5.128,6.594 8.386,9.527 1.954,1.737 4.098,3.393 6.432,4.966 2.334,1.574 4.993,2.932 7.98,4.071 2.984,1.14 6.297,2.064 9.934,2.769 3.637,0.706 7.735,1.059 12.294,1.059 2.279,0 4.423,-0.109 6.432,-0.326 2.009,-0.218 3.937,-0.435 5.782,-0.652 2.279,-0.216 4.288,-0.434 6.026,-0.651 1.735,-0.217 3.473,-0.325 5.209,-0.325 2.172,0 4.506,0.19 7.004,0.57 2.498,0.378 5.157,1.331 7.98,2.849 L 42.989,27.197 c -0.216,-0.979 -0.46,-2.064 -0.731,-3.258 -0.271,-1.194 -0.406,-2.388 -0.406,-3.583 0,-1.411 0.38,-2.606 1.137,-3.581 0.763,-0.979 2.227,-1.468 4.398,-1.468 1.194,0 2.443,0.137 3.746,0.409 1.304,0.27 2.553,0.623 3.747,1.059 L 43.317,1.791 c -2.498,-1.302 -4.912,-2.171 -7.246,-2.604 -2.334,-0.435 -4.588,-0.652 -6.76,-0.652 -1.194,0 -2.795,0.108 -4.803,0.325 -2.009,0.218 -3.963,0.869 -5.863,1.954 -1.899,1.087 -3.528,2.743 -4.886,4.968 -1.356,2.225 -2.035,5.347 -2.035,9.363 0,0.761 0.055,1.466 0.162,2.117 0.109,0.651 0.247,1.412 0.408,2.281 0.162,0.868 0.38,1.9 0.651,3.094 0.273,1.193 0.624,2.714 1.059,4.56 l 8.305,36.966 c -0.869,0.543 -2.009,1.113 -3.419,1.709 -1.413,0.597 -2.932,0.895 -4.561,0.895 -2.93,0 -5.753,-1.166 -8.467,-3.501 -2.714,-2.334 -5.076,-5.318 -7.085,-8.955 -2.008,-3.637 -3.609,-7.709 -4.803,-12.214 -1.194,-4.506 -1.793,-8.93 -1.793,-13.273 0,-5.102 1.358,-8.766 4.072,-10.992 2.714,-2.225 5.917,-3.338 9.609,-3.338 0.542,0 1.005,0.027 1.384,0.082 0.38,0.053 0.732,0.134 1.059,0.243 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,994.5084,689.72373)" /><path   id="path10"   d="m 0,0 c -5.321,-2.496 -10.478,-4.151 -15.471,-4.967 -4.993,-0.813 -9.77,-1.22 -14.329,-1.22 -9.338,0 -17.238,1.383 -23.696,4.151 -6.458,2.77 -11.698,6.406 -15.715,10.912 -4.018,4.504 -6.948,9.663 -8.793,15.47 -1.847,5.809 -2.768,11.753 -2.768,17.833 0,4.777 0.461,9.635 1.382,14.574 0.924,4.939 2.336,9.771 4.236,14.493 1.899,4.724 4.288,9.201 7.163,13.435 2.878,4.235 6.216,8.035 10.017,11.399 7.273,6.406 15.008,10.722 23.204,12.948 8.199,2.226 16.369,3.338 24.511,3.338 4.017,0 8.305,-0.299 12.864,-0.896 4.561,-0.597 9.554,-1.819 14.982,-3.664 L 14.818,83.704 c -2.17,2.931 -4.504,5.185 -7.002,6.759 -2.498,1.574 -4.886,2.741 -7.165,3.501 -2.28,0.76 -4.317,1.221 -6.107,1.384 -1.791,0.163 -3.068,0.244 -3.828,0.244 -4.884,0 -9.661,-1.194 -14.329,-3.582 -4.667,-2.389 -8.794,-5.809 -12.377,-10.26 -3.583,-4.45 -6.461,-9.879 -8.63,-16.285 -2.173,-6.405 -3.258,-13.679 -3.258,-21.821 0,-1.085 0.081,-2.66 0.244,-4.723 0.162,-2.062 0.516,-4.315 1.059,-6.757 0.544,-2.445 1.385,-4.941 2.524,-7.492 1.14,-2.552 2.743,-4.886 4.803,-7.002 2.064,-2.118 4.614,-3.828 7.655,-5.13 3.04,-1.303 6.731,-1.955 11.074,-1.955 0.869,0 2.225,0.056 4.07,0.164 1.847,0.109 4.155,0.542 6.923,1.303 2.769,0.759 5.972,1.9 9.607,3.419 3.637,1.52 7.681,3.692 12.132,6.514 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,915.90573,683.42693)" /><path   id="path11"   d="m 0,0 c 1.847,0 4.046,0.272 6.596,0.816 2.55,0.542 4.587,1.302 6.107,2.279 l -20.03,-90.706 c -0.544,-2.173 -0.869,-3.773 -0.978,-4.805 -0.107,-1.031 -0.162,-1.71 -0.162,-2.036 0,-1.194 0.216,-2.116 0.651,-2.767 0.434,-0.652 0.923,-1.141 1.467,-1.466 0.541,-0.326 1.137,-0.543 1.79,-0.652 0.651,-0.108 1.249,-0.164 1.791,-0.164 0.869,0 1.927,0.082 3.176,0.245 1.249,0.164 2.85,0.571 4.804,1.223 l -11.725,-14.983 c -2.932,-1.52 -5.591,-2.442 -7.98,-2.769 -2.388,-0.325 -4.343,-0.488 -5.862,-0.488 -3.801,0 -6.84,0.488 -9.12,1.465 -2.279,0.977 -4.046,2.226 -5.292,3.747 -1.249,1.519 -2.063,3.174 -2.443,4.966 -0.38,1.791 -0.57,3.502 -0.57,5.13 0,1.954 0.19,3.88 0.57,5.781 0.38,1.899 0.895,4.424 1.548,7.573 l 7.977,36.64 c -1.626,1.304 -3.093,2.117 -4.394,2.444 -1.304,0.325 -2.389,0.486 -3.258,0.486 -2.932,0 -5.701,-1.165 -8.305,-3.501 -2.605,-2.334 -4.887,-5.318 -6.841,-8.954 -1.954,-3.638 -3.473,-7.737 -4.559,-12.297 -1.087,-4.56 -1.628,-9.011 -1.628,-13.353 0,-1.194 0.109,-2.579 0.325,-4.153 0.216,-1.575 0.76,-3.122 1.629,-4.641 0.869,-1.52 2.118,-2.795 3.744,-3.826 1.629,-1.032 3.908,-1.548 6.841,-1.548 0.65,0 1.194,0.028 1.628,0.082 0.435,0.054 0.869,0.134 1.301,0.243 l -8.628,-15.144 c -3.151,-0.76 -6.46,-1.14 -9.934,-1.14 -1.413,0 -3.666,0.217 -6.757,0.652 -3.096,0.433 -6.19,1.601 -9.284,3.5 -3.094,1.901 -5.808,4.833 -8.144,8.794 -2.334,3.963 -3.5,9.473 -3.5,16.529 0,7.708 1.575,15.2 4.723,22.474 3.148,7.274 7.6,13.516 13.353,18.728 5.646,5.101 11.264,8.413 16.855,9.933 5.592,1.519 11.21,2.28 16.856,2.28 2.17,0 3.962,-0.053 5.373,-0.164 1.413,-0.108 3.528,-0.434 6.351,-0.977 l 3.094,13.517 c 0.869,3.475 1.384,6.026 1.545,7.654 0.164,1.629 0.248,2.715 0.248,3.257 0,1.412 -0.219,2.985 -0.654,4.722 -0.434,1.738 -1.683,3.528 -3.744,5.374 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1282.4215,536.64653)" /><path   id="path12"   d="m 0,0 c 23.104,-48.987 71.897,-78.523 127.259,-78.523 70.137,0 135.31,47.11 158.324,112.164 -27.323,-79.542 -101.25,-132.98 -180.809,-132.98 -62.801,0 -118.145,33.504 -145.844,88.566 l 10.363,16.286 z"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,777.15667,724.02173)" /><path   id="path13"   d="m 0,0 h -70.429 v 21.396 c 0,19.435 15.75,35.245 35.185,35.245 C -15.75,56.641 0,40.831 0,21.396 Z m -27.886,-55.971 6.374,-22.039 h -26.746 l 5.67,22.039 h 0.123 c -4.803,2.595 -8.104,7.614 -8.104,13.456 0,8.48 6.875,15.354 15.354,15.354 8.48,0 15.354,-6.874 15.354,-15.354 0,-5.842 -3.301,-10.861 -8.104,-13.456 z M 17.177,0 v 25.438 c -0.12,1.664 -0.298,3.328 -0.595,4.992 -4.279,24.725 -25.854,43.565 -51.826,43.565 -25.913,0 -47.488,-18.84 -51.768,-43.565 -0.534,-2.912 -0.772,-5.943 -0.772,-9.034 V 0 c -9.45,-0.119 -16.998,-7.726 -16.998,-17.117 v -72.212 c 0,-9.51 7.667,-17.177 17.176,-17.177 H 17.177 c 9.449,0 17.176,7.667 17.176,17.177 v 72.212 C 34.353,-7.667 26.626,0 17.177,0"   style="fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none"   transform="matrix(1.3333333,0,0,-1.3333333,1502.3944,564.5552)" /> </g> </g></svg>
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/corvuspay-woocommerce-integration.php /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/corvuspay-woocommerce-integration.php
--- /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/corvuspay-woocommerce-integration.php	2026-05-18 12:47:06.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/corvuspay-woocommerce-integration.php	2026-06-18 09:41:54.000000000 +0000
@@ -3,7 +3,7 @@
  * Plugin Name: CorvusPay WooCommerce Payment Gateway
  * Plugin URI: https://www.corvuspay.com/
  * Description: Extends WooCommerce with CorvusPay Credit Card payments.
- * Version: 2.7.4
+ * Version: 2.7.5
  * Author: Corvus Pay d.o.o.
  * Author URI: https://www.corvuspay.com/
  * Copyright: © 2026 Corvus Pay
@@ -24,7 +24,7 @@
 }
 
 define( 'WC_CORVUSPAY_SETTINGS_VERSION', 4 );
-define( 'WC_CORVUSPAY_VERSION', '2.7.4' );
+define( 'WC_CORVUSPAY_VERSION', '2.7.5' );
 define( 'WC_CORVUSPAY_FILE', __FILE__ );
 define( 'WC_CORVUSPAY_PATH', dirname( __FILE__ ) );
 
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/includes/class-wc-gateway-corvuspay.php /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/includes/class-wc-gateway-corvuspay.php
--- /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/includes/class-wc-gateway-corvuspay.php	2026-04-14 07:05:58.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/includes/class-wc-gateway-corvuspay.php	2026-06-18 09:41:54.000000000 +0000
@@ -779,7 +779,7 @@
 		try {
 			$this->log->debug( 'Enter corvuspay_cancel_handler $_POST: ' . wp_json_encode( $_POST ) );
 
-			$order = new WC_Order_CorvusPay( $this->log, $this->options, 'callback' );
+			$order = new WC_Order_CorvusPay( $this->log, $this->options, 'callback-signed' );
 
 			$this->log->info( 'Cancel URL for Order ' . $order->get_id() . '.' );
 
@@ -1710,7 +1710,7 @@
 		if ( isset( $approval_code ) && isset( $transaction_date ) ) {
 			echo '<p>' . __( 'Payment successful - payment card account debited.', 'corvuspay-woocommerce-integration' ) . '</p>
                   <ul>
-                    <li>' . __( 'Approval code: ', 'corvuspay-woocommerce-integration' ) . $approval_code . ' </li>
+                    <li>' . __( 'Approval code: ', 'corvuspay-woocommerce-integration' ) . esc_html( $approval_code ) . ' </li>
                     <li>' . __( 'Transaction date and time: ', 'corvuspay-woocommerce-integration' ) . $transaction_date . '</li>
                   </ul>';
 		}
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/includes/class-wc-order-corvuspay.php /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/includes/class-wc-order-corvuspay.php
--- /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/includes/class-wc-order-corvuspay.php	2024-05-16 11:45:00.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/includes/class-wc-order-corvuspay.php	2026-06-18 09:41:54.000000000 +0000
@@ -174,20 +174,31 @@
 	        $post_id = $this->get_post_by_corvuspay_order_number( $this->parameters['order_number'] );
 
 	        if ( null === $post_id ) {
-		        $this->log->error( 'The parameter $post_id is null. There is no post with 
+		        $this->log->error( 'The parameter $post_id is null. There is no post with
 		        _corvuspay_order_number equals ' . $this->parameters['order_number'] );
 	        }
 
 	        parent::__construct( $post_id );
-			
-			if ( 'callback-signed' === $type ) {
-				if ( isset( $this->parameters["approval_code"] ) && $this->parameters["approval_code"] != null ) {
-					$this->update_meta_data( '_corvuspay_approval_code', $this->parameters["approval_code"] );
-					$this->update_meta_data( '_corvuspay_transaction_date', current_time( "d.m.Y H:i:s" ) );
-				}
+
+            if ( 'callback-signed' === $type ) {
                 $res = $this->client->validate->signature( $this->parameters );
-                $this->log->debug( 'Result from signature validation: ' . $res );
-			}
+                $this->log->debug( 'Result from signature validation: ' . ( $res ? 'true' : 'false' ) );
+
+                if ( ! $res ) {
+                    throw new Exception( 'Invalid CorvusPay signature.' );
+                }
+
+                if ( isset( $this->parameters['approval_code'] ) && null !== $this->parameters['approval_code'] ) {
+                    $this->update_meta_data(
+                        '_corvuspay_approval_code',
+                        sanitize_text_field( $this->parameters['approval_code'] )
+                    );
+                    $this->update_meta_data(
+                        '_corvuspay_transaction_date',
+                        current_time( 'd.m.Y H:i:s' )
+                    );
+                }
+            }
 		} elseif ( 'api' === $type || 'api-status' === $type || 'api-renew' === $type ) {
 	        /* Existing order for API */
 	        parent::__construct( $order );
@@ -699,7 +710,7 @@
      * Get post by meta value when meta key is "_corvuspay_order_number".
      *
      * @param string $corvuspay_order_number
-     * 
+     *
      * @return int|null id of last post with '_corvuspay_order_number' == $corvuspay_order_number or null if not exists.
      */
 	private function get_post_by_corvuspay_order_number( $corvuspay_order_number ) {
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/languages/corvuspay-woocommerce-integration.pot /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/languages/corvuspay-woocommerce-integration.pot
--- /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/languages/corvuspay-woocommerce-integration.pot	2026-04-14 07:05:58.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/languages/corvuspay-woocommerce-integration.pot	2026-06-18 09:41:54.000000000 +0000
@@ -2,7 +2,7 @@
 # This file is distributed under the same license as the CorvusPay WooCommerce Payment Gateway plugin.
 msgid ""
 msgstr ""
-"Project-Id-Version: CorvusPay WooCommerce Payment Gateway 2.7.3\n"
+"Project-Id-Version: CorvusPay WooCommerce Payment Gateway 2.7.5\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/corvuspay-woocommerce-integration\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/readme.txt /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/readme.txt
--- /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.4/readme.txt	2026-05-18 12:47:06.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/corvuspay-woocommerce-integration/2.7.5/readme.txt	2026-06-18 09:41:54.000000000 +0000
@@ -3,7 +3,7 @@
 Tags: payment, credit card, corvuspay, woocommerce
 Requires at least: 6.0
 Tested up to: 7
-Stable tag: 2.7.4
+Stable tag: 2.7.5
 Requires PHP: 7.4
 License: GNU General Public License v2.0 (or later)
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -125,6 +125,11 @@
 10. CorvusPay Wallet stored credit card.
 
 == Changelog ==
+= 2.7.5 =
+* Changed: New version of DinaCard logo.
+* Improved: Added signature validation for CorvusPay success and cancel callback requests to prevent unauthorized order completion and cancellation.
+* Improved: Prevented stored XSS via approval_code by validating callback signatures before storing data, sanitizing approval_code values, and escaping output in order details and emails.
+
 = 2.7.4 =
 * Changed: Removed unnecessary PHP SDK folders/files (examples, assets, configuration files) and updated WordPress 7 compatibility.

Exploit Outline

The exploit targets the publicly accessible REST API endpoint at `/wp-json/corvuspay/cancel/` or the legacy WooCommerce API hook `woocommerce_api_corvuspay-cancel`. An attacker sends a POST request to this endpoint containing a valid WooCommerce `order_number`. Because the plugin's REST route registration uses `'permission_callback' => '__return_true'` and the cancellation handler fails to verify the CorvusPay HMAC signature (by using the unsigned 'callback' routine instead of 'callback-signed'), the plugin will transition the status of the specified order to 'cancelled' without requiring any authentication or proof that the request originated from the payment provider.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/402f1f9f-35c7-4304-891b-a07f3e84c189?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database