CVE-2026-91017: unknown robokassa payment gateway for woocommerce
Vulnerability summary
CVE-2026-91017 is a medium (CVSS 5.3) vulnerability in unknown robokassa payment gateway for woocommerce. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.8.9.
Timeline
- 17-09-2026PublishedVulnerability first disclosed.
- 17-09-2026Last modifiedVulnerability information updated.
Description
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.03 pp
From 0.10% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Affected systems
Unknown1 product
Wordpress1 product
- robokassa≤ 1.8.8 (fixed in 1.8.9)
2 vendors · 2 products