CVE-2026-16947 Overview
CVE-2026-16947 is a Server-Side Request Forgery (SSRF) vulnerability in the Total processing card payments for WooCommerce WordPress plugin through version 7.3. The plugin fails to validate a user-supplied path before using it to build a server-side verification request. It also does not verify the authenticity of the response. Unauthenticated attackers can redirect the verification request to an arbitrary host to disclose the merchant's payment-gateway credentials. Attackers can also forge a success response to mark arbitrary WooCommerce orders as paid, enabling payment fraud against merchants.
Critical Impact
Unauthenticated attackers can steal payment-gateway credentials and mark arbitrary WooCommerce orders as paid without payment.
Affected Products
- Total processing card payments for WooCommerce WordPress plugin
- All versions through 7.3
- WordPress sites running WooCommerce with this payment integration
Discovery Timeline
- 2026-08-29 - CVE-2026-16947 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-16947
Vulnerability Analysis
The vulnerability is classified under [CWE-918] Server-Side Request Forgery. The plugin constructs a server-side verification request using a path controlled by the client. Without validation, the target host of that request can be manipulated by an attacker. The plugin then trusts the response body without verifying its authenticity or origin.
Two attack outcomes result from this design flaw. First, redirecting the request to an attacker-controlled host causes the plugin to transmit the merchant's payment-gateway credentials to that host. Second, an attacker-controlled endpoint can return a forged success response, causing WooCommerce to mark orders as paid without any actual payment.
Root Cause
The root cause is missing input validation on the user-supplied path parameter that determines the destination of the outbound verification request. Compounding this, the plugin lacks response authenticity checks such as cryptographic signature verification or fixed-host allow-listing against the legitimate payment gateway.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker crafts a checkout or verification request that specifies a path pointing to an attacker-controlled server. The plugin then issues an outbound request that carries merchant credentials to the attacker's host. The attacker's server returns a JSON response mimicking the legitimate gateway's success format, and the plugin marks the associated WooCommerce order as paid.
See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-16947
Indicators of Compromise
- Outbound HTTP/HTTPS requests from the WordPress server to unexpected external hosts during checkout flows
- WooCommerce orders marked as completed or processing with no matching transaction in the payment gateway dashboard
- Web server access logs showing checkout endpoints invoked with anomalous path or URL parameters
- Unexpected disclosures of payment-gateway API keys observed in threat-intel or credential-leak feeds
Detection Strategies
- Correlate WooCommerce order status changes against payment-gateway settlement records to identify orders paid without a real charge
- Inspect PHP request logs for calls to the plugin's verification endpoints containing attacker-controlled path or host values
- Deploy web application firewall rules that flag checkout parameters containing full URLs, protocol schemes, or path-traversal sequences
Monitoring Recommendations
- Enable egress network logging on WordPress hosts and alert on outbound connections to hosts outside the payment gateway's known IP ranges
- Monitor WooCommerce audit logs for high-velocity order completions from single IPs or without corresponding customer accounts
- Track payment-gateway API credential usage for anomalous source IPs
How to Mitigate CVE-2026-16947
Immediate Actions Required
- Deactivate the Total processing card payments for WooCommerce plugin until a fixed version is available
- Rotate all payment-gateway API credentials that were configured in the plugin, as they may have been exfiltrated
- Reconcile recent WooCommerce orders against payment-gateway settlements and cancel any orders without matching transactions
- Restrict outbound network access from the WordPress server to only the payment gateway's official API endpoints
Patch Information
No fixed version has been published at the time of NVD entry. All versions through 7.3 remain vulnerable. Consult the WPScan Vulnerability Report for updates on remediation.
Workarounds
- Replace the plugin with an alternative WooCommerce payment integration that performs server-to-server verification against a hardcoded gateway host
- Configure a host-based egress firewall or proxy that only permits outbound HTTPS to the payment gateway's documented API domains
- Add a web application firewall rule to block checkout requests containing URL schemes or absolute paths in gateway parameters
- Enable payment-gateway webhooks and manually confirm order status through gateway-signed callbacks rather than plugin-initiated verification
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
