All vulnerabilities
CVE-2026-91076

Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed

Unknown Robokassa payment gateway for WoocommerceNetwork & edge
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.9.0Fixed versionCVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 1.9.0Robokassa payment gateway for WoocommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

Text from CVE List

Affected versions 1

  • Robokassa payment gateway for Woocommerceaffected: all versions before 1.9.0CVE List

References 1