Security Alert Summary
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
CVE Details
- CVE ID: CVE-2026-91017
- Affected component: Robokassa payment gateway for Woocommerce (WordPress plugin)
- Affected versions: Versions less than 1.8.9
- Published: September 17, 2026 at 07:16:28 AM
- Last modified: September 17, 2026 at 01:17:00 PM
- CVSS v3.1: Base score 3.7 (LOW) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness (CWE): CWE-345
Technical Details
When the plugin’s non-default deferred-payment feature is enabled, the plugin does not verify the authenticity of incoming payment notifications. An unauthenticated actor can craft a notification that the plugin accepts as valid, even though it lacks a valid signature or payment. As a result, the plugin may update WooCommerce order status to paid or on-hold based on the forged notification.
The issue exists because the verification step for incoming notifications is missing or bypassed under the deferred-payment configuration. No specific functions or REST endpoints are named in the available information.
The practical impact is limited to order integrity: orders can be marked as paid or placed on-hold without a corresponding valid payment. The vulnerability does not indicate disclosure of sensitive data or a direct availability impact.
How This Could Impact Your Website
Consider a small ecommerce site with a site owner, internal staff handling orders, and an external contractor who helps with fulfillment. If the Robokassa plugin is configured to use the deferred-payment feature, an attacker could submit forged payment notifications that mark orders as paid. Staff may then fulfill or ship items based on the incorrect order status, creating financial loss, customer disputes, and extra workload for support staff.
Other practical consequences include exposure of internal operational problems such as incorrect order records, reconciliation errors between payment and order systems, and an increased risk of targeted phishing or social engineering against staff who handle order processing or customer service.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- If you use the deferred-payment feature, consider disabling it until you can confirm the plugin performs proper notification verification.
- Review and reduce unnecessary user roles, especially contributor-level and similar accounts with limited oversight.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and order activity for unusual behavior, such as orders marked paid without corresponding payment records.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
