CVE-2026-9027 describes an improper verification of cryptographic signature vulnerability (CWE-347) in the CorvusPay WooCommerce Payment Gateway plugin for WordPress. The plugin registers a REST endpoint POST /wp-json/corvuspay/success/ with an open permission callback, allowing unauthenticated access. Although the endpoint calls a signature validation function and logs the result, it does not act on the validation outcome. Consequently, the order payment is marked complete regardless of signature validity. Because WooCommerce order IDs are sequential, attackers can enumerate order numbers and forge payment completions, enabling payment bypass and unauthorized acquisition of goods or services.

An attacker can mark any pending WooCommerce order as paid without providing a valid cryptographic signature or authenticating, resulting in unauthorized order completion. This leads to potential financial loss for merchants as goods or services may be delivered without actual payment. The vulnerability does not impact confidentiality or availability but compromises the integrity of the payment process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict access to the vulnerable REST endpoint if possible, or implement custom validation to ensure signature verification results are enforced before marking orders as paid. Monitor vendor channels for updates and apply official patches promptly once released.