CVE-2026-91076

Deferred Deferred - Pending Action

Unauthenticated Order State Manipulation in Robokassa for WooCommerce

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91076

EUVD

EUVD-2026-100862

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Robokassa	payment gateway for Woocommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Robokassa payment gateway plugin for WooCommerce before version 1.9.0. It allows unauthenticated attackers to change the status of any WooCommerce order to 'failed' without verifying the payment-notification request. Attackers exploit sequential order identifiers to remove orders from the fulfillment queue one by one.

Detection Guidance

Check if your Robokassa payment gateway for WooCommerce plugin version is below 1.9.0. Look for unusual order status changes to 'failed' without corresponding payment activity. Monitor server logs for repeated failed order status updates from the same IP addresses.

Impact Analysis

This vulnerability can lead to financial losses if legitimate orders are falsely marked as failed, disrupting order fulfillment. It may also cause reputational damage due to incorrect order statuses and potential customer dissatisfaction. Businesses relying on WooCommerce for order processing are particularly at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to payment processing integrity rather than data protection. However, it could indirectly impact compliance by disrupting order fulfillment processes, potentially leading to unauthorized order cancellations or financial discrepancies that may violate record-keeping or audit requirements in regulated environments.

Mitigation Strategies

Immediately update the Robokassa payment gateway for WooCommerce plugin to version 1.9.0 or later. If updating is not possible, disable the plugin temporarily until a patch is applied. Review all recent orders for unauthorized status changes and revert any suspicious 'failed' statuses.

Hi! I’m here to help you understand CVE-2026-91076. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70