Robokassa accepts forged payment notifications when deferred payment is enabled
Robokassa payment gateway for WooCommerce before 1.8.9 fails to verify incoming payment-notification authenticity when its non-default deferred-payment feature is enabled. An unauthenticated attacker can forge a notification to mark arbitrary WooCommerce orders paid or on-hold without making a payment or supplying a valid signature. The export does not name the callback route, order-ID field or notification-handling function. The configuration prerequisite is essential; the record does not establish the same flaw in default payment mode.
- Component
- Robokassa payment gateway for Woocommerce
- Plugin slug
robokassa- Affected
- < 1.8.9
- Safe version
1.8.9- Published
- Sep 17, 2026
This CVE was published Sep 17, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
Update Robokassa payment gateway for WooCommerce to 1.8.9 or later. Disable deferred payment until updated. Verify provider signatures before processing any notification, bind the authenticated transaction to the correct order and expected payment details, and reject replays. Reconcile changed order states with genuine gateway receipts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N