CVE-2026-0679: Fortis for WooCommerce Auth Bypass Flaw

CVE-2026-0679 Overview

CVE-2026-0679 is an authorization bypass vulnerability in the Fortis for WooCommerce plugin for WordPress. The flaw exists in the check_fortis_notify_response function, which contains an inverted nonce check. The logic error allows unauthenticated attackers to update arbitrary WooCommerce order statuses to paid, processing, or completed. Attackers can mark orders as paid without submitting any payment. All plugin versions up to and including 1.2.0 are affected. The weakness is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated attackers can mark WooCommerce orders as paid without processing any payment, resulting in fraudulent order fulfillment and direct financial loss to store operators.

Affected Products

Fortis for WooCommerce plugin for WordPress, versions up to and including 1.2.0
WordPress sites running WooCommerce with the Fortis payment gateway enabled
E-commerce deployments accepting payments through the Fortis gateway integration

Discovery Timeline

2026-02-04 - CVE-2026-0679 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0679

Vulnerability Analysis

The vulnerability resides in the check_fortis_notify_response function inside WC_Gateway_Fortis.php at line 1674. This function processes payment notification callbacks from the Fortis payment gateway and updates WooCommerce order statuses based on the response. The function performs a nonce verification check to confirm the request originates from a legitimate payment notification.

The authorization logic is inverted. Instead of rejecting requests when nonce validation fails, the function proceeds with order status updates when the nonce is invalid or missing. Requests with valid nonces are blocked, while unauthenticated requests are accepted. This inverted condition transforms a security control into an open endpoint.

An attacker can send a crafted HTTP request to the notify endpoint referencing any order identifier. The plugin will update the targeted order to paid, processing, or completed without payment verification. Store operators may then ship goods or deliver digital products for orders that were never paid.

Root Cause

The root cause is a logic error in conditional flow control. The nonce verification check returns a boolean, and the surrounding code branches on the wrong value. This pattern reflects [CWE-862: Missing Authorization], where the authorization decision is effectively absent because the check resolves opposite to its intended purpose.

Attack Vector

Exploitation requires only network access to the WordPress site. No authentication, user interaction, or prior privileges are needed. The attacker sends an HTTP request to the Fortis notify response endpoint, supplying the target WooCommerce order ID. Because the inverted nonce check passes when no valid nonce is supplied, the plugin updates the order status as if the gateway had confirmed payment. The full vulnerable code path is documented in the WordPress Fortis Gateway Code.

Detection Methods for CVE-2026-0679

Indicators of Compromise

WooCommerce orders transitioning to processing or completed status without corresponding gateway transaction logs from Fortis
HTTP requests to the Fortis notify callback URL from unexpected source IP addresses or user agents
Order status changes occurring outside normal customer checkout flows or business hours
Fulfillment notifications generated for orders lacking matching payment capture records

Detection Strategies

Reconcile WooCommerce order status changes against the Fortis merchant portal transaction ledger to surface orders marked paid without a matching settlement
Enable verbose logging on the WordPress site and inspect web server access logs for repeated POST requests targeting the Fortis notification endpoint
Deploy a Web Application Firewall (WAF) rule that inspects requests to the plugin's callback URL and flags traffic missing valid gateway signatures

Monitoring Recommendations

Forward WordPress and WooCommerce application logs to a centralized logging platform for correlation against shipment and fulfillment events
Alert on bulk order status transitions to completed within short time windows, which indicates automated exploitation
Monitor outbound shipping label generation and digital download token issuance for orders flagged as paid in the last 30 days

How to Mitigate CVE-2026-0679

Immediate Actions Required

Update the Fortis for WooCommerce plugin to a version released after 1.2.0 that addresses the inverted nonce check
Audit all WooCommerce orders marked paid, processing, or completed since the plugin was installed and verify each against Fortis settlement records
Place a temporary block on the Fortis notify callback URL at the WAF or reverse proxy layer until the patch is applied
Halt fulfillment on any order that cannot be reconciled with a confirmed Fortis transaction

Patch Information

The vendor published a fix tracked in the WordPress Fortis Changeset that corrects the conditional logic in check_fortis_notify_response. Administrators should upgrade via the WordPress plugin dashboard. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Disable the Fortis for WooCommerce plugin until the patched version is deployed, switching customers to an alternate payment gateway
Restrict the notify callback URL at the web server level to only accept requests from documented Fortis gateway IP ranges
Require manual review of every order status transition to completed before fulfillment workflows execute

bash

# Nginx configuration restricting Fortis callback to gateway IPs
location ~* /wc-api/wc_gateway_fortis {
    allow 203.0.113.0/24;   # Replace with Fortis gateway IP range
    deny all;
    proxy_pass http://wordpress_backend;
}