CVE-2026-91017
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
| Vendor | unknown |
| Product | robokassa payment gateway for woocommerce |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown robokassa payment gateway for woocommerce
Be the first to know when new low vulnerabilities affecting unknown robokassa payment gateway for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Robokassa payment gateway for Woocommerce
0 < 1.8.9
References
Credits
Pedro Pinho WPScan