CVE-2026-78536
MediumCVSS 6.5Summary
The Robokassa payment gateway for WooCommerce in versions up to and including 1.8.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control enables unauthorized operations.
Risk Assessment
An unauthenticated attacker can bypass access control mechanisms in the payment gateway, potentially leading to transaction manipulation or data exposure. This may result in financial losses.
Recommendation
Update the Robokassa gateway for WooCommerce to a version newer than 1.8.9 containing the fix. Review transaction logs for suspicious activity.
Other vulnerabilities in Robokassa payment gateway for WooCommerce
See all- CVE-2026-91076Medium
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it. This allows unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
- CVE-2026-91017Low
The Robokassa payment gateway for WooCommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Original NVD description (English source)
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS