CVE-2026-73399: Flutterwave WooCommerce Auth Bypass Flaw

CVE-2026-73399 Overview

CVE-2026-73399 is a broken authentication vulnerability affecting the Flutterwave WooCommerce payment gateway plugin for WordPress. The flaw impacts versions 3.3.0 and earlier of the rave-woocommerce-payment-gateway plugin. An unauthenticated attacker can reach the affected authentication flow over the network without user interaction. The weakness is categorized under CWE-288, Authentication Bypass Using an Alternate Path or Channel. Successful exploitation can compromise integrity and availability of the payment processing workflow within affected WooCommerce stores.

Critical Impact
Unauthenticated network attackers can bypass authentication controls in the Flutterwave WooCommerce plugin, potentially manipulating payment-related transactions on affected WordPress stores.

Affected Products

Flutterwave WooCommerce plugin (rave-woocommerce-payment-gateway) versions <= 3.3.0
WordPress installations running WooCommerce with the affected plugin enabled
E-commerce sites using Flutterwave as a payment gateway

Discovery Timeline

2026-08-18 - CVE-2026-73399 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73399

Vulnerability Analysis

The vulnerability is a broken authentication flaw classified under CWE-288. Attackers can invoke a sensitive plugin code path without providing valid authentication credentials. The flaw is reachable over the network with low complexity and requires no privileges or user interaction. Impact is limited to integrity and availability, with no direct confidentiality impact reported. Because the plugin handles payment gateway logic, integrity impact translates to potential manipulation of transaction state or order data. Exploitation does not require any authenticated session, making the attack surface accessible to any remote adversary.

Root Cause

The root cause is an alternate authentication path that fails to verify the identity of the requester before processing sensitive operations. Plugins that expose payment callbacks or WordPress AJAX actions frequently rely on shared tokens or webhook validation. When those checks are missing or malformed, unauthenticated actors can invoke privileged behavior. The Patchstack advisory attributes the issue to the plugin's authentication logic in versions up to and including 3.3.0.

Attack Vector

The attack vector is remote network access to a WordPress site running the vulnerable plugin. An attacker crafts HTTP requests targeting the plugin's affected endpoint without supplying valid credentials or session tokens. No user interaction is required. Verified proof-of-concept code is not publicly available for this issue. Refer to the Patchstack Vulnerability Advisory for additional context.

Detection Methods for CVE-2026-73399

Indicators of Compromise

Unexpected HTTP POST requests to Flutterwave plugin endpoints under /wp-content/plugins/rave-woocommerce-payment-gateway/ or associated WordPress AJAX actions
WooCommerce orders transitioning to paid or completed states without corresponding gateway confirmation records
Requests originating from unknown IPs to payment callback URLs outside expected Flutterwave source ranges

Detection Strategies

Monitor WordPress and WooCommerce logs for anomalous order status changes lacking matching payment provider transactions
Correlate HTTP access logs with Flutterwave webhook signatures to identify unsigned or malformed callbacks
Alert on repeated unauthenticated requests to plugin endpoints from single source IPs

Monitoring Recommendations

Enable verbose logging on the WooCommerce order lifecycle and reconcile with the Flutterwave merchant dashboard
Deploy a web application firewall (WAF) rule set that inspects requests to rave-woocommerce-payment-gateway paths
Track plugin version inventory across all WordPress hosts to identify vulnerable installations

How to Mitigate CVE-2026-73399

Immediate Actions Required

Identify all WordPress sites running the Flutterwave WooCommerce plugin at version 3.3.0 or earlier
Update the plugin to a fixed release above 3.3.0 as published by the vendor
Audit recent WooCommerce orders for unauthorized state transitions or payment reconciliation gaps

Patch Information

Refer to the Patchstack Vulnerability Advisory for the current fixed version and remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files on disk. Verify the installed version after update by checking the plugin metadata in the WordPress admin dashboard.

Workarounds

Disable the Flutterwave WooCommerce plugin until the patched version can be deployed
Restrict access to plugin callback endpoints using WAF rules or server-level IP allow lists limited to Flutterwave webhook sources
Enforce Flutterwave webhook signature validation at an upstream reverse proxy where feasible

bash

# Configuration example: identify vulnerable plugin version on a WordPress host
grep -E "Version:\s*" wp-content/plugins/rave-woocommerce-payment-gateway/*.php
# Update via WP-CLI once the vendor releases a fixed version
wp plugin update rave-woocommerce-payment-gateway