low3.7
CVE-2026-91017
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-def…
Impact
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Affected products
| Product | Affected versions |
|---|---|
| Robokassa Payment Gateway For Woocommerce WordPress Plugin | before 1.8.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.