CVE-2026-91076: Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Stores using the Robokassa payment for WooCommerce WordPress plugin at a version earlier than 1.9.0 are exposed. An attacker can target orders without authenticating to the store.
What does an attacker need to exploit it?
The attacker only needs to send a payment-notification request that names an order. Because order identifiers are sequential, orders can be targeted one at a time.
What is the operational impact of exploitation?
An attacker can change any WooCommerce order to the failed state. This can remove orders from the fulfilment queue and disrupt order processing.
How can I determine whether a store may have been affected?
Review WooCommerce orders for unexpected transitions to the failed state, particularly across sequential order identifiers. Also check whether the installed plugin version is earlier than 1.9.0.