Robokassa payment gateway for Woocommerce < 1.8.9 – Unauthenticated Payment Bypass via Forged JWT Callback | CVE 2026-91017

Description

The plugin does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

Proof of Concept

Prerequisites: WooCommerce active with the Robokassa gateway, and the plugin's non-default deferred-payments (hold) option enabled by the store administrator. At least one WooCommerce order exists in the pending state; its numeric id is INVID. An attacker obtains their own order id at checkout, and WooCommerce order ids are sequential.

As an unauthenticated attacker, build a three-part token whose middle segment is the standard base64 encoding of the JSON payload, and POST the raw token to the payment-notification endpoint:

  PAYLOAD=$(printf '%s' '{"data":{"state":"OK","invId":INVID}}' | base64 | tr -d '\n')
  curl -sk -X POST -H 'Content-Type: application/json' --data-raw "aaaa.${PAYLOAD}.bbbb" 'https://victim.example/?robokassa=result'

Response is HTTP 200 and order INVID transitions from pending to processing (a paid status). Using "state":"HOLD" instead moves the order to on-hold. No signature, key, amount, or order key is supplied.