CVE-2026-16947: CWE-918 Server-Side Request Forgery (SSRF) in Total processing card payments for WooCommerce

The Total processing card payments for WooCommerce plugin through version 7.3 contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). It does not validate user-supplied paths used in server-side verification requests and lacks verification of response authenticity. Consequently, unauthenticated attackers can redirect these requests to arbitrary hosts, exposing sensitive merchant payment-gateway credentials. Additionally, attackers can forge success responses to mark arbitrary WooCommerce orders as paid without authorization. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity. No patch or official remediation has been documented yet.

An unauthenticated attacker can exploit this SSRF vulnerability to redirect server-side verification requests to arbitrary hosts, leading to disclosure of merchant payment-gateway credentials. Furthermore, the attacker can forge success responses to fraudulently mark WooCommerce orders as paid, potentially causing financial loss and undermining transaction integrity. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for suspicious activity related to order payments. Avoid exposing the plugin to untrusted users or inputs that could trigger the vulnerable request paths.