CVE-2026-6939: CorvusPay WooCommerce XSS Vulnerability

CVE-2026-6939 Overview

CVE-2026-6939 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the CorvusPay WooCommerce Payment Gateway plugin for WordPress. All versions up to and including 2.7.4 fail to sanitize input and escape output for the approval_code parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes when a user views the affected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true. A signature validation step exists but only logs its result without halting execution, allowing an attacker to submit any signature and persist malicious content.

Critical Impact
Unauthenticated attackers can persist arbitrary JavaScript in WordPress databases, enabling session theft, admin account takeover, and drive-by attacks against site visitors and administrators.

Affected Products

CorvusPay WooCommerce Payment Gateway plugin for WordPress, versions through 2.7.4
WordPress sites using the vulnerable corvuspay-woocommerce-integration plugin
WooCommerce stores exposing the /wp-json/corvuspay/success/ REST endpoint

Discovery Timeline

2026-07-11 - CVE-2026-6939 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-6939

Vulnerability Analysis

The vulnerability resides in the CorvusPay WooCommerce integration's payment success callback handler. The plugin registers POST /wp-json/corvuspay/success/ as a public REST route intended to receive payment confirmation data from the CorvusPay processor. Because the endpoint accepts and stores the approval_code parameter without sanitization or output escaping, injected content is rendered verbatim when the associated order page is later viewed.

Attackers can send crafted requests directly to the endpoint from any network location. The stored payload executes in the browser context of any user visiting the affected page, including WooCommerce administrators reviewing order details. This creates a path to admin session hijacking, credential theft through injected forms, and pivoting into further WordPress compromise.

Root Cause

Two compounding flaws produce the vulnerability. First, the REST route uses permission_callback => __return_true, which unconditionally authorizes any caller and removes authentication requirements. Second, the signature check that would normally validate CorvusPay-originated requests only writes the result to a log rather than rejecting invalid signatures. The approval_code value is then written to the database and later emitted in HTML without applying esc_html(), esc_attr(), or wp_kses() sanitization.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to /wp-json/corvuspay/success/ supplying an arbitrary signature and an approval_code value containing HTML or JavaScript markup. Because the signature comparison does not halt execution, the plugin proceeds to persist the attacker-controlled string tied to an order record. When a site user or administrator views the order or a page rendering the value, the injected script executes in their browser under the site's origin.

The vulnerability manifests in the CorvusPay success handler. See the Wordfence Vulnerability Report and the WordPress Plugin Change Set for the code-level details of the fix.

Detection Methods for CVE-2026-6939

Indicators of Compromise

Unexpected POST requests to /wp-json/corvuspay/success/ from IPs outside the CorvusPay gateway range
Order records containing HTML tags, <script> elements, or javascript: URIs in the approval_code field
WordPress access logs showing REST calls to the CorvusPay success endpoint without matching prior checkout activity
Administrator browser sessions triggering unexpected outbound requests when viewing WooCommerce order pages

Detection Strategies

Review the WooCommerce orders table and post meta for approval_code values containing angle brackets, event handlers, or script tags
Correlate WordPress REST API logs for /wp-json/corvuspay/success/ calls against legitimate checkout flows to identify unmatched submissions
Monitor web server logs for POST requests with abnormally large or non-alphanumeric approval_code payloads

Monitoring Recommendations

Enable WordPress audit logging for REST API calls and plugin option changes
Deploy a Web Application Firewall (WAF) rule blocking <, >, and script keywords in requests to the CorvusPay endpoint
Alert on administrator sessions performing unexpected privileged actions shortly after viewing order pages

How to Mitigate CVE-2026-6939

Immediate Actions Required

Update the CorvusPay WooCommerce Payment Gateway plugin to a version newer than 2.7.4 that includes the fix referenced in the WordPress plugin changeset
Audit all WooCommerce orders for approval_code values containing HTML or script content and purge malicious entries
Rotate WordPress administrator credentials and invalidate active sessions if injection is confirmed
Restrict access to /wp-json/corvuspay/success/ at the WAF or reverse-proxy layer to known CorvusPay source addresses

Patch Information

A fix is available through the WordPress plugin repository. Refer to the WordPress Plugin Change Set for the specific code changes and the Wordfence Vulnerability Report for remediation guidance. Administrators should upgrade using the WordPress plugin update mechanism and verify the installed version is above 2.7.4.

Workarounds

Deactivate the CorvusPay WooCommerce Payment Gateway plugin until the patched version is installed
Enforce IP allowlisting on the /wp-json/corvuspay/success/ endpoint to permit only CorvusPay gateway hosts
Apply a WAF rule that strips or blocks HTML characters in the approval_code request parameter

bash

# Example NGINX rule restricting the CorvusPay success endpoint to allowlisted IPs
location = /wp-json/corvuspay/success/ {
    allow 192.0.2.0/24;   # replace with CorvusPay gateway ranges
    deny all;
    proxy_pass http://wordpress_backend;
}