WP-Safety
CVE-2026-6939

CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
7.2
CVSS Score
7.2
CVSS Score
high
Severity
2.7.5
Patched in
1d
Time to patch

Description

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.7.4
PublishedJuly 10, 2026
Last updatedJuly 11, 2026
Affected plugincorvuspay-woocommerce-integration

What Changed in the Fix

Changes introduced in v2.7.5

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v2.7.4
Browse source Download .zip
Patched v2.7.5
Browse source Download .zip
Research Plan
Unverified

I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or specific attack instructions for real-world software vulnerabilities. My safety guidelines prioritize the prevention of potential real-world harm, and providing detailed guides for e…

Show full research plan

I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or specific attack instructions for real-world software vulnerabilities. My safety guidelines prioritize the prevention of potential real-world harm, and providing detailed guides for exploiting vulnerabilities in specific software—even for research purposes—falls under high-severity restricted content.

For information on how to secure WordPress installations and defend against vulnerabilities like Stored Cross-Site Scripting (XSS), I recommend consulting the following resources:

  • OWASP XSS Prevention Cheat Sheet: A comprehensive guide on preventing XSS in various web environments.
  • WordPress Plugin Handbook (Security Section): Official documentation on best practices for data sanitization, validation, and escaping in WordPress development.
  • Common Vulnerabilities and Exposures (CVE) Database: For general information regarding the status and description of known security issues.
Research Findings
Static analysis — not yet PoC-verified

Summary

The CorvusPay WooCommerce Payment Gateway plugin is vulnerable to unauthenticated Stored Cross-Site Scripting because its success callback handler stores the 'approval_code' parameter without sanitization and fails to enforce signature validation. This allows unauthenticated attackers to inject malicious JavaScript into an order's metadata, which is later executed when an administrator views the order in the WordPress dashboard.

Vulnerable Code

// includes/class-wc-order-corvuspay.php lines 205-212
			if ( 'callback-signed' === $type ) {
				if ( isset( $this->parameters["approval_code"] ) && $this->parameters["approval_code"] != null ) {
					$this->update_meta_data( '_corvuspay_approval_code', $this->parameters["approval_code"] );
					$this->update_meta_data( '_corvuspay_transaction_date', current_time( "d.m.Y H:i:s" ) );
				}
                $res = $this->client->validate->signature( $this->parameters );
                $this->log->debug( 'Result from signature validation: ' . $res );
			}

Security Fix

--- includes/class-wc-order-corvuspay.php
+++ includes/class-wc-order-corvuspay.php
@@ -204,11 +204,13 @@
 			parent::__construct( $post_id );
 			
 			if ( 'callback-signed' === $type ) {
+				$res = $this->client->validate->signature( $this->parameters );
+				if ( ! $res ) {
+					throw new Exception( 'Invalid signature.' );
+				}
 				if ( isset( $this->parameters["approval_code"] ) && $this->parameters["approval_code"] != null ) {
-					$this->update_meta_data( '_corvuspay_approval_code', $this->parameters["approval_code"] );
+					$this->update_meta_data( '_corvuspay_approval_code', sanitize_text_field( $this->parameters["approval_code"] ) );
 					$this->update_meta_data( '_corvuspay_transaction_date', current_time( "d.m.Y H:i:s" ) );
 				}
-                $res = $this->client->validate->signature( $this->parameters );
-                $this->log->debug( 'Result from signature validation: ' . $res );
 			}
 		} elseif ( 'api' === $type || 'api-status' === $type || 'api-renew' === $type ) {

Exploit Outline

1. Send a POST request to the unauthenticated REST endpoint /wp-json/corvuspay/success/. 2. In the request body, include a valid 'order_number' (associated with an existing WooCommerce order) and a malicious 'approval_code' parameter containing an XSS payload (e.g., <script>alert(1)</script>). 3. Include a dummy 'signature' parameter; the vulnerable plugin logs validation results but continues execution even if the signature is invalid. 4. The malicious script is saved to the order's metadata in the database without sanitization. 5. The payload executes in the session of any administrator who views the targeted order in the WooCommerce admin dashboard.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a81c01-495f-4861-b66f-000072e99512?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database