CVE-2026-0679: Fortis WooCommerce Auth Bypass Vulnerability

CVE-2026-0679 Overview

CVE-2026-0679 is an authorization bypass vulnerability affecting the Fortis for WooCommerce plugin for WordPress. The vulnerability exists due to an inverted nonce check in the check_fortis_notify_response function, allowing unauthenticated attackers to manipulate WooCommerce order statuses without proper authorization. This flaw enables malicious actors to mark orders as paid, processing, or completed without actually completing payment, potentially leading to significant financial losses for e-commerce businesses.

Critical Impact

Unauthenticated attackers can mark WooCommerce orders as paid without completing actual payment, enabling order fraud and financial theft from affected e-commerce stores.

Affected Products

• Fortis for WooCommerce plugin versions up to and including 1.2.0
• WordPress sites using the vulnerable Fortis for WooCommerce plugin
• WooCommerce stores integrated with Fortis payment gateway

Discovery Timeline

• February 4, 2026 - CVE-2026-0679 published to NVD
• February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0679

Vulnerability Analysis

This authorization bypass vulnerability (CWE-862: Missing Authorization) stems from a logic error in the payment notification handling mechanism of the Fortis for WooCommerce plugin. The vulnerable function check_fortis_notify_response contains an inverted nonce check, which means the security validation logic is reversed—requests that should be rejected are accepted, and valid requests may be denied.

WordPress nonce (Number used ONCE) checks are a critical security mechanism designed to protect against unauthorized actions and CSRF attacks. When this check is inverted, the intended security boundary is completely undermined, allowing unauthenticated users to bypass the authorization controls entirely.

The impact of this vulnerability is particularly severe for e-commerce operations, as attackers can manipulate order statuses to appear as if payment has been completed when no actual payment transaction occurred.

Root Cause

The root cause is an inverted conditional logic in the nonce verification within the check_fortis_notify_response function located in WC_Gateway_Fortis.php at line 1674. Instead of denying requests with invalid nonces, the function accepts them, creating a complete bypass of the authorization mechanism. This type of logic error typically occurs when developers incorrectly use negation operators or misunderstand the return values of WordPress security functions like wp_verify_nonce().

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests directly to the vulnerable endpoint, exploiting the inverted nonce check to modify WooCommerce order statuses. The attack flow involves:

1. Identifying a WordPress site using the Fortis for WooCommerce plugin version 1.2.0 or earlier
2. Crafting a request to the payment notification endpoint with an invalid or missing nonce
3. Including order manipulation parameters to change order status to paid/processing/completed
4. Submitting the request, which is incorrectly accepted due to the inverted nonce validation

The vulnerability is exploitable remotely without any privileges, making it accessible to any attacker with network access to the targeted WordPress site. For detailed technical analysis, refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review.

Detection Methods for CVE-2026-0679

Indicators of Compromise

• Unusual order status changes without corresponding payment gateway transaction records
• Orders marked as paid/processing/completed with missing or invalid payment confirmation data
• Web server logs showing suspicious requests to WooCommerce payment notification endpoints from unknown IP addresses
• Discrepancies between payment processor records and WooCommerce order statuses

Detection Strategies

• Monitor WooCommerce order logs for status changes that lack corresponding Fortis payment gateway transaction IDs
• Implement web application firewall (WAF) rules to detect and alert on unusual patterns of requests to payment notification endpoints
• Review web server access logs for repeated requests to /wp-json/ or WooCommerce callback endpoints from suspicious sources
• Cross-reference order completion events with actual payment processor confirmations

Monitoring Recommendations

• Enable detailed logging for all WooCommerce order status changes and payment gateway callbacks
• Set up alerts for orders that change to paid status without matching transaction records in your payment processor dashboard
• Implement real-time monitoring of order volume anomalies that could indicate automated exploitation
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to monitor WordPress installations for suspicious activity

How to Mitigate CVE-2026-0679

Immediate Actions Required

• Update the Fortis for WooCommerce plugin to a patched version immediately if available
• Temporarily disable the Fortis for WooCommerce plugin if no patch is available and switch to an alternative payment gateway
• Audit all recent orders for potential fraudulent status modifications
• Review server logs for evidence of exploitation attempts

Patch Information

Site administrators should check for updates to the Fortis for WooCommerce plugin through the WordPress plugin repository. The vulnerability affects all versions up to and including 1.2.0. Monitor the WordPress Plugin Development page for the latest version with security fixes. Contact the plugin developer if no patched version is available.

Workarounds

• Implement additional server-side validation for payment notification requests using web server configuration or WAF rules
• Add custom validation logic to verify order payments directly with the Fortis payment gateway API before accepting status changes
• Restrict access to payment callback endpoints to known Fortis gateway IP addresses if documented by the payment provider
• Enable WordPress activity logging plugins to track all order modifications for forensic purposes

# Example: Restrict access to WooCommerce callbacks via .htaccess (adjust IPs as needed)
# Add to WordPress .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/.*fortis.*notify [NC]
    RewriteCond %{REMOTE_ADDR} !^(TRUSTED_IP_1|TRUSTED_IP_2)$
    RewriteRule .* - [F,L]
</IfModule>