CVE-2026-16947: Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

Q: Who can exploit this issue?

An attacker does not need to authenticate to exploit the vulnerable payment-verification flow. Affected sites are those using the Total Processing Card Payments for WooCommerce plugin through version 7.3.

Q: What can an attacker achieve?

An attacker can redirect the server-side verification request to an arbitrary host, which can disclose the merchant's payment-gateway credentials. They can also forge a successful verification response and cause arbitrary WooCommerce orders to be marked as paid.

Q: What conditions make payment bypass possible?

The payment bypass relies on the plugin accepting a user-influenced verification path and failing to verify that the returned response is authentic. This permits an attacker-controlled host to provide a forged success response.

Published Aug 29, 2026

Updated

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.

Affected Software

1 affected component

WordPress WooCommerce Total Processing Card Payments plugin<=7.3

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker does not need to authenticate to exploit the vulnerable payment-verification flow. Affected sites are those using the Total Processing Card Payments for WooCommerce plugin through version 7.3.

What can an attacker achieve?

An attacker can redirect the server-side verification request to an arbitrary host, which can disclose the merchant's payment-gateway credentials. They can also forge a successful verification response and cause arbitrary WooCommerce orders to be marked as paid.

What conditions make payment bypass possible?

The payment bypass relies on the plugin accepting a user-influenced verification path and failing to verify that the returned response is authentic. This permits an attacker-controlled host to provide a forged success response.

CVE-2026-16947: Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker achieve?

What conditions make payment bypass possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker achieve?

What conditions make payment bypass possible?