CVE-2026-91017 — Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

CVE-2026-91017

Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback PUBLISHED

Description (CNA)

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

Affected (CNA)

Vendor / product	Versions
Unknown / Robokassa payment gateway for Woocommerce	affected 0 before 1.8.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1aeef0b4-9b14-4b03-b7f6-a05937622023/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.