CVE-2026-56029 describes an unauthenticated broken authentication vulnerability (CWE-288) in CorvusPay WooCommerce Payment Gateway versions up to 2.7.4. The flaw allows attackers to bypass authentication controls via an alternate path or channel, potentially enabling unauthorized actions that compromise data integrity. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability enables unauthenticated attackers to bypass authentication, leading to a high impact on data integrity within the affected payment gateway. There is no direct confidentiality or availability impact reported. Exploitation could allow unauthorized modification or manipulation of payment-related data or transactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No official mitigation or temporary workaround is currently documented.