CVE-2026-91017
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Robokassa payment gateway for WooCommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Risk Assessment
An attacker can mark any order as paid without paying, leading to financial loss and shipment of goods without payment. The risk applies only to sites with the deferred-payment feature enabled.
Recommendation
Update the Robokassa payment gateway for WooCommerce plugin to version 1.8.9 or later. If the deferred-payment feature is not used, consider disabling it until the update is applied.
Other vulnerabilities in Robokassa payment gateway for WooCommerce
See all- CVE-2026-78536Medium
The Robokassa payment gateway for WooCommerce in versions up to and including 1.8.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control enables unauthorized operations.
- CVE-2026-91076Medium
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it. This allows unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Original NVD description (English source)
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS