Security Alert Summary
The Total processing card payments for WooCommerce plugin up to and including version 7.3 contains a server-side request forgery and response forgery issue. The plugin does not validate a user-supplied path before using it to build a server-side verification request, and it does not verify the authenticity of the response. An unauthenticated attacker can redirect verification requests to an arbitrary host and can forge a success response that marks WooCommerce orders as paid, and may disclose the merchant’s payment-gateway credentials.
CVE Details
- CVE ID: CVE-2026-16947
- Affected component: Total processing card payments for WooCommerce (WordPress plugin)
- Affected versions: All versions through 7.3 (as stated in the advisory)
- Published date: August 29, 2026 at 6:17:05 AM UTC
- Last modified: August 29, 2026 at 6:17:05 AM UTC
- CVSS v3.1 base score / severity / vector: Not provided in the advisory
- Authentication / privileges / user interaction:
- Authentication required: None (unauthenticated attacker)
- Privileges required: None
- User interaction: Not required
- Primary impact:
- Confidentiality: Disclosure of merchant’s payment-gateway credentials is possible via redirected verification requests
- Integrity: Ability to forge a success response that marks arbitrary WooCommerce orders as paid
- Availability: Not specified
- CWE / weakness ID: Not provided
Technical Details
According to the advisory, the plugin fails to validate a user-supplied path before constructing a server-side verification request, and it also fails to verify the authenticity of the verification response. Because the plugin builds a request using attacker-controlled input and trusts the resulting response, an attacker can redirect the server-side request to an arbitrary host. That redirect may reveal sensitive information sent to the verification endpoint, including merchant credentials used for the payment gateway. Separately, by forging a verification response that the plugin accepts as authentic, an attacker can cause the plugin to mark WooCommerce orders as paid without a valid payment.
The advisory does not name specific functions, hooks, or REST endpoints; it describes a lack of input validation on the path used to build the verification request and a lack of response authentication checks. The impact is limited to the behaviors described: disclosure of gateway credentials and falsified payment verification leading to orders marked as paid.
How This Could Impact Your Website
Consider a WooCommerce store where the site owner, an internal staff member handling orders, and an external contractor (for example, a developer or payment integrator) all interact with the site. An attacker exploiting this issue could redirect verification requests away from the legitimate payment gateway, potentially capturing credentials used to access that gateway. With those credentials, the attacker might perform fraudulent actions against the merchant account or craft convincing communications that enable targeted phishing against staff or customers.
Separately, forged verification responses could cause orders to be marked as paid when they are not, creating accounting discrepancies, inventory errors, and customer service burdens such as shipping unpaid orders or processing refunds and chargebacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available; do not assume a fix is present until confirmed by the vendor.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege accounts that may be abused to supply input.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site to reduce attack surface.
- Monitor site and ecommerce activity for unusual behavior, such as unexpected order status changes, login attempts, or administrative actions from unfamiliar IP addresses.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
