[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCbPhw_gXqfD4kd3PetswG5J_5lVoMQnlfH-eDQjKE2w":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":35},"CVE-2026-9027","corvuspay-woocommerce-payment-gateway-unauthenticated-improper-verification-of-cryptographic-signature-to-payment-bypass","CorvusPay WooCommerce Payment Gateway \u003C= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via \u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F REST Endpoint","The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The `corvuspay_success_handler` function registers the REST endpoint `POST \u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F` with `'permission_callback' => '__return_true'`, and while it calls `$this->client->validate->signature()` and stores the boolean result in `$res`, the result is never evaluated in a conditional — it is only written to the debug log — causing execution to unconditionally reach `$order->payment_complete()` regardless of whether the cryptographic signature is valid. This makes it possible for unauthenticated attackers to mark any pending WooCommerce order as fully paid by sending a POST request to the success endpoint containing an arbitrary or forged signature value, allowing them to obtain goods or services without payment. Because WooCommerce order IDs are sequential integers, target orders are trivially enumerable via the `order_number` POST parameter, requiring no prior knowledge of the victim order.","corvuspay-woocommerce-integration",null,"\u003C=2.7.4","2.7.5","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Improper Verification of Cryptographic Signature","2026-07-08 20:40:59","2026-07-09 09:31:20",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F3bc9f344-b605-4257-8d77-e073f85fe344?source=api-prod",1,[22,23,24,25,26,27],"assets\u002Fimg\u002Fcards\u002Fdina.svg","corvuspay-woocommerce-integration.php","includes\u002Fclass-wc-gateway-corvuspay.php","includes\u002Fclass-wc-order-corvuspay.php","languages\u002Fcorvuspay-woocommerce-integration.pot","readme.txt","researched",false,3,"# Exploitation Research Plan: CorvusPay WooCommerce Payment Gateway Payment Bypass (CVE-2026-9027)\n\n## 1. Vulnerability Summary\nThe **CorvusPay WooCommerce Payment Gateway** plugin (versions \u003C= 2.7.4) contains a critical logic flaw in its payment confirmation handler. The plugin registers an unauthenticated REST API endpoint `POST \u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F` to receive payment success notifications from the CorvusPay gateway. While the plugin correctly computes and validates the cryptographic signature of the incoming request, it **fails to act on the validation result**. The boolean result of the signature check is written to a debug log, but the code execution continues unconditionally to mark the associated WooCommerce order as \"Paid\" via `$order->payment_complete()`. This allows an attacker to spoof payment success messages for any order.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `POST \u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F`\n- **Authentication:** Unauthenticated (`'permission_callback' => '__return_true'`).\n- **Target Parameter:** `order_number` (The WooCommerce order ID or the plugin-formatted order number).\n- **Payload Parameters:** `signature` (can be arbitrary), `approval_code` (can be arbitrary).\n- **Preconditions:** A WooCommerce order must exist in a status that allows payment completion (e.g., \"Pending payment\").\n\n## 3. Code Flow\n1. **Hook Registration:** In `includes\u002Fclass-wc-gateway-corvuspay.php`, the plugin hooks into `rest_api_init`:\n   ```php\n   add_action( 'rest_api_init', array( $this, 'register_corvuspay_rest_routes' ) );\n   ```\n2. **Route Definition:** The `register_corvuspay_rest_routes` function (implied by description) registers the `\u002Fsuccess\u002F` endpoint with no permission checks.\n3. **Handler Execution:** The `corvuspay_success_handler` is invoked upon a POST request.\n4. **Order Initialization:** The handler instantiates `WC_Order_CorvusPay` with the `callback-signed` type.\n5. **Vulnerable Signature Check:** In `includes\u002Fclass-wc-order-corvuspay.php` (Lines 185-188):\n   ```php\n   if ( 'callback-signed' === $type ) {\n       \u002F\u002F ... (meta updates)\n       $res = $this->client->validate->signature( $this->parameters );\n       $this->log->debug( 'Result from signature validation: ' . $res );\n   }\n   ```\n   The variable `$res` captures the truth value of the signature, but there is no `if (!$res)` check following this.\n6. **Payment Completion:** Back in the success handler (in `includes\u002Fclass-wc-gateway-corvuspay.php`), the code proceeds to call `$order->payment_complete()`, transitioning the order status and granting the user the product\u002Fservice.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability resides in a **REST API endpoint** registered with `'permission_callback' => '__return_true'`. \n- **Nonce Requirement:** None. Standard WordPress REST API nonces (`_wpnonce`) are not required for endpoints that do not implement permission checks or are intended for external webhooks.\n- **Verification:** The `register_corvuspay_rest_routes` function explicitly enables unauthenticated access.\n\n## 5. Exploitation Strategy\nThe goal is to move a \"Pending\" order to \"Processing\u002FCompleted\" without a valid CorvusPay signature.\n\n### Step-by-Step Plan:\n1. **Identify Order Number:** Determine a valid WooCommerce order number. Since these are sequential integers, an attacker can iterate through numbers or use the order ID generated during their own checkout.\n2. **Determine Parameter Format:** The plugin uses `order_number` in the POST body. Note that `WC_Order_CorvusPay::ORDER_NUMBER_DELIMITER` is `' - '`. If the site is in \"Test Mode\", the order number might be prefixed (e.g., `Test - 123`). In production, it is typically just the ID.\n3. **Craft the Request:** Send a POST request to the REST endpoint.\n\n### HTTP Request (Example):\n- **Method:** `POST`\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F`\n- **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body:** `order_number=123&signature=invalid_fake_signature&approval_code=999999`\n\n## 6. Test Data Setup\n1. **Install Dependencies:** Ensure WooCommerce is active.\n2. **Configure Plugin:** Enable the CorvusPay gateway in WooCommerce settings (`\u002Fwp-admin\u002Fadmin.php?page=wc-settings&tab=checkout&section=corvuspay`).\n3. **Create Order:** \n   - Use WP-CLI to create a pending order for a customer:\n     ```bash\n     wp eval '$order = wc_create_order(); $order->add_product(wc_get_product(PAGE_ID), 1); $order->set_status(\"pending\"); $order->save(); echo \"Order ID: \" . $order->get_id();'\n     ```\n   - Alternatively, use the browser to add a product to the cart and proceed to checkout, selecting CorvusPay but not completing the payment.\n\n## 7. Expected Results\n- The server should respond with a `200 OK` or a successful JSON status.\n- The WooCommerce order notes should show that the payment was completed.\n- The order status should change from `pending` to `processing` or `completed`.\n\n## 8. Verification Steps\nAfter sending the `http_request`, verify the order status via WP-CLI:\n```bash\n# Replace 123 with the actual Order ID\nwp wc order get 123 --field=status\n```\nExpected output: `processing` or `completed`.\n\nCheck the order metadata to see the spoofed approval code:\n```bash\nwp post shadow-meta list 123 --keys=_corvuspay_approval_code\n```\n\n## 9. Alternative Approaches\nIf the REST endpoint `\u002Fwp-json\u002Fcorvuspay\u002Fsuccess\u002F` is blocked or behaves unexpectedly, the plugin also registers a legacy WooCommerce API hook:\n- **Action:** `woocommerce_api_corvuspay-success`\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002F?wc-api=corvuspay-success`\n- **Mechanism:** This calls the same `corvuspay_success_handler` function. The same payload should be sent via POST to this URL if the REST route is unavailable.","gemini-3-flash-preview","2026-07-15 22:18:38","2026-07-15 22:19:09",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","2.7.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags\u002F2.7.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcorvuspay-woocommerce-integration.2.7.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags\u002F2.7.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcorvuspay-woocommerce-integration.2.7.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcorvuspay-woocommerce-integration\u002Ftags"]