CVE-2026-56029: CorvusPay WooCommerce Auth Bypass Flaw

CVE-2026-56029 Overview

CVE-2026-56029 is an unauthenticated broken authentication vulnerability affecting the CorvusPay WooCommerce Payment Gateway plugin for WordPress in versions up to and including 2.7.4. The flaw is categorized under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel) and allows remote attackers to bypass authentication controls without prior credentials or user interaction. Successful exploitation impacts the integrity of the payment workflow, enabling attackers to manipulate transaction data or authenticated operations exposed by the plugin. The vulnerability is network-exploitable over HTTP(S) and requires no privileges, making WordPress sites running WooCommerce with CorvusPay integration accessible to opportunistic attacks.

Critical Impact
Remote unauthenticated attackers can bypass authentication in the CorvusPay WooCommerce Payment Gateway plugin, compromising the integrity of payment-related operations on affected WordPress sites.

Affected Products

CorvusPay WooCommerce Payment Gateway plugin versions <= 2.7.4
WordPress sites running WooCommerce with the CorvusPay integration enabled
E-commerce deployments processing payments through CorvusPay

Discovery Timeline

2026-06-26 - CVE-2026-56029 published to the National Vulnerability Database
2026-06-26 - Last updated in the NVD database

Technical Details for CVE-2026-56029

Vulnerability Analysis

The CorvusPay WooCommerce Payment Gateway plugin fails to properly enforce authentication on one or more code paths that should require verified identity. Classified as [CWE-288], the flaw represents an alternate path around the plugin's intended authentication logic. Attackers reach protected functionality by invoking endpoints or callback handlers that do not validate the caller's identity or session state.

Because the plugin mediates payment gateway interactions, the affected code paths likely handle transaction callbacks, order state changes, or administrative operations. The advisory published by Patchstack indicates the impact is confined to integrity, meaning attackers can modify or forge protected data without necessarily reading confidential information or degrading availability.

Exploitation requires only network access to the target WordPress site. No user interaction, credentials, or elevated privileges are needed, and the attack complexity is low. Details of the affected endpoint are documented in the Patchstack Vulnerability Report.

Root Cause

The root cause is missing or improperly implemented authentication checks on plugin request handlers. The plugin exposes functionality reachable via unauthenticated HTTP requests, likely through WordPress hooks such as admin-ajax.php actions, REST API routes, or payment callback URLs, without verifying nonces, capabilities, or signed callback tokens.

Attack Vector

An attacker sends crafted HTTP requests to the exposed plugin endpoint over the network. Because privileges required and user interaction are both none, exploitation can be automated across large numbers of WordPress sites. The EPSS score for CVE-2026-56029 is 0.294% (percentile 21.142), indicating current exploitation likelihood is limited but non-trivial given the plugin's e-commerce role.

No verified public proof-of-concept code is available at this time. Refer to the Patchstack Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2026-56029

Indicators of Compromise

Unauthenticated HTTP requests to CorvusPay plugin endpoints under /wp-content/plugins/corvuspay-woocommerce-integration/ or plugin-registered REST routes
Unexpected changes to WooCommerce order states, payment statuses, or transaction records without corresponding authenticated admin activity
Access patterns hitting plugin callback URLs from IP addresses not associated with the legitimate CorvusPay processor

Detection Strategies

Inventory WordPress installations and identify sites running CorvusPay WooCommerce Payment Gateway <= 2.7.4
Review web server access logs for anomalous POST requests to plugin AJAX or REST endpoints without valid session cookies or nonces
Correlate WooCommerce order modification events with authenticated user sessions to surface orders altered outside legitimate admin workflows

Monitoring Recommendations

Enable audit logging on WordPress and WooCommerce to record all order state transitions and administrative actions
Alert on payment status changes that occur without a matching authenticated administrator or documented gateway callback source
Monitor outbound traffic from the WordPress host for unexpected connections that may indicate post-exploitation activity

How to Mitigate CVE-2026-56029

Immediate Actions Required

Identify all WordPress sites running the CorvusPay WooCommerce Payment Gateway plugin and confirm installed versions
Update the plugin to a version above 2.7.4 as soon as a fixed release is published by the vendor
Restrict administrative and plugin endpoint access at the web application firewall (WAF) or reverse proxy layer while patching is in progress
Audit recent WooCommerce transactions and order modifications for signs of tampering

Patch Information

The vulnerability affects CorvusPay WooCommerce Payment Gateway versions <= 2.7.4. Consult the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply the vendor-supplied update through the WordPress plugin management interface once available.

Workarounds

Deploy WAF rules to block unauthenticated requests to the plugin's REST and AJAX endpoints until a patched release is installed
Temporarily disable the CorvusPay plugin on non-production or low-traffic sites where the payment gateway is not actively required
Enforce IP allowlisting on payment callback URLs so that only legitimate CorvusPay processor IPs can reach them

bash

# Example: block unauthenticated access to the plugin path at the nginx layer
location ~* /wp-content/plugins/corvuspay-woocommerce-integration/ {
    # Restrict to known CorvusPay callback source IPs
    allow 192.0.2.0/24;   # replace with vendor-provided IP range
    deny  all;
}