CVE-2026-91017: Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Robokassa payment gateway for Woocommerce WordPress pluginto a version that resolves this vulnerability.Fixed in 1.8.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using versions before 1.8.9 are exposed only when the plugin's non-default deferred-payment feature is enabled. The described issue is not stated to affect installations where that feature is disabled.
What does an attacker need to exploit this issue?
An attacker does not need authentication, a valid payment, or a valid notification signature. Exploitation requires forging a payment notification while the deferred-payment feature is enabled.
What is the practical impact of a successful attack?
An attacker can cause arbitrary WooCommerce orders to be marked as paid or on-hold. The provided data does not indicate confidentiality impact or service disruption.
What can be done if upgrading is not immediately possible?
Disable the plugin's deferred-payment feature, since it is the non-default condition under which incoming payment notifications are not authenticated.