CVE-2026-91017: Robokassa WooCommerce Auth Bypass Flaw

CVE-2026-91017 Overview

CVE-2026-91017 affects the Robokassa payment gateway for WooCommerce WordPress plugin in versions prior to 1.8.9. The plugin fails to verify the authenticity of incoming payment notifications when the non-default deferred-payment feature is enabled. Unauthenticated attackers can forge notifications and mark arbitrary WooCommerce orders as paid or on-hold without submitting payment or a valid signature. The flaw is tracked under CWE-345: Insufficient Verification of Data Authenticity. Exploitation requires the deferred-payment configuration to be active, which raises attack complexity but does not require any privileges or user interaction.

Critical Impact

Attackers can mark WooCommerce orders as paid without submitting funds, causing direct financial loss to merchants when the deferred-payment feature is enabled.

Affected Products

• Robokassa payment gateway for WooCommerce WordPress plugin versions before 1.8.9
• WooCommerce installations using the deferred-payment (non-default) feature
• WordPress sites processing Robokassa transactions through the vulnerable plugin

Discovery Timeline

• 2026-09-17 - CVE-2026-91017 published to the National Vulnerability Database
• 2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-91017

Vulnerability Analysis

The Robokassa plugin exposes a notification endpoint that receives payment status callbacks from the Robokassa processor. Under normal operation, incoming notifications carry a cryptographic signature that the plugin must validate before updating order state. When the deferred-payment feature is enabled, the plugin's notification handler skips authenticity checks and accepts the request payload as trusted input.

An unauthenticated attacker can craft an HTTP request that mimics a legitimate Robokassa callback. The plugin processes the forged payload and transitions the referenced WooCommerce order to a paid or on-hold state. Merchants may then release goods, provision services, or trigger fulfillment workflows for orders that were never funded. Because the attack targets only integrity of order status, confidentiality and availability remain unaffected, which aligns with the reported CWE-345 classification.

Root Cause

The root cause is a missing signature verification branch in the deferred-payment code path. The plugin trusts the request parameters, including order identifiers and status fields, without recomputing or comparing the expected HMAC. This design defect grants any network-reachable actor the same trust boundary as the payment processor.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker enumerates order identifiers, then issues a forged POST request to the plugin's notification handler with parameters indicating a successful or pending payment. The plugin updates the order without validating the signature. Additional details are available in the WPScan Vulnerability Report.

// No verified public exploit code is available for CVE-2026-91017.
// Refer to the WPScan advisory linked above for technical details.

Detection Methods for CVE-2026-91017

Indicators of Compromise

• WooCommerce orders transitioning to paid or on-hold status without a corresponding Robokassa transaction record in merchant reconciliation logs
• Inbound HTTP POST requests to the Robokassa notification callback endpoint originating from IP addresses outside Robokassa's published address ranges
• Order status changes occurring outside normal business hours or from unusual geographies
• Fulfillment events triggered for orders lacking matching entries in the Robokassa merchant dashboard

Detection Strategies

• Correlate WooCommerce order state transitions with Robokassa processor confirmations and flag mismatches for review
• Inspect web server access logs for anomalous request volumes to the plugin's notification handler URL
• Alert on repeated notification requests referencing sequential or enumerated order identifiers

Monitoring Recommendations

• Log all HTTP requests to the Robokassa notification endpoint, including source IP, request body, and response code
• Enable WordPress audit logging for WooCommerce order status transitions and administrator actions
• Route web server and application logs to a centralized SIEM for signature-mismatch and anomaly analytics

How to Mitigate CVE-2026-91017

Immediate Actions Required

• Upgrade the Robokassa payment gateway for WooCommerce plugin to version 1.8.9 or later
• If patching is delayed, disable the deferred-payment feature in the plugin settings to remove the vulnerable code path
• Reconcile recent WooCommerce orders against the Robokassa merchant dashboard and reverse fulfillment for any unfunded orders

Patch Information

The vendor addressed the issue in Robokassa payment gateway for WooCommerce version 1.8.9. The fix restores signature verification on the deferred-payment notification path. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Disable the non-default deferred-payment feature until the plugin is upgraded to version 1.8.9 or later
• Restrict access to the Robokassa notification callback endpoint using web application firewall rules that allow only Robokassa's published source IP ranges
• Require manual review of order status changes before fulfillment while the vulnerable configuration is active

# Example WAF rule concept: allow only Robokassa source IPs to reach the notification endpoint
# Replace <robokassa-ip-range> with the vendor's published ranges
location ~ /wc-api/wc_robokassa {
    allow <robokassa-ip-range>;
    deny all;
}