CVE-2026-16947

Deferred Deferred - Pending Action

Authentication Bypass in Total Processing for WooCommerce

Publication date: 2026-08-29

Last updated on: 2026-08-30

Assigner: WPScan

Description

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-29

Last Modified

2026-08-30

Generated

2026-09-19

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-16947

EUVD

EUVD-2026-68044

Affected Vendors & Products

Vendor	Product	Version / Range
total_processing	card_payments_for_woocommerce	to 7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is an unauthenticated Server-Side Request Forgery (SSRF) flaw in the Total Processing Card Payments for WooCommerce plugin. It allows attackers to manipulate server-side verification requests by supplying a user-controlled path without validation. The plugin fails to verify response authenticity, enabling redirection to arbitrary hosts to steal payment gateway credentials and forge order payment confirmations.

Detection Guidance

Check if the Total Processing Card Payments for WooCommerce plugin version 7.3 or below is installed. Inspect network traffic for unexpected outbound requests to external hosts from the server. Look for unusual payment gateway credential disclosures or forged order status updates in logs.

Impact Analysis

Attackers could steal your payment gateway credentials, allowing them to intercept or manipulate transactions. They can also mark WooCommerce orders as paid without actual payment, leading to financial losses. Merchants using vulnerable plugin versions are at risk of unauthorized access and fraudulent transactions.

Compliance Impact

This vulnerability could lead to unauthorized access to payment data, violating GDPR's data protection requirements and HIPAA's safeguards for financial information. Merchants may face compliance violations, legal penalties, and reputational damage due to exposed payment credentials and fraudulent transactions.

Mitigation Strategies

Immediately update the plugin to the latest version if available. If no update exists, disable the plugin until a patch is released. Restrict outbound server requests to trusted hosts and monitor network traffic for SSRF attempts. Review order statuses for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-16947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70