{"id":"CVE-2026-91076","revision":"04470e727b3b4b46a234e4294e43f023","records":[{"revision":"04470e727b3b4b46a234e4294e43f023","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-91076","aliases":[],"title":"Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed","description":"The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.","state":0,"publishedAt":"2026-10-14T06:00:15.064+00:00","modifiedAt":"2026-10-15T10:32:38.491+00:00","affected":[{"ecosystem":"Vendor product","name":"Robokassa payment gateway for Woocommerce","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Robokassa payment gateway for Woocommerce\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.9.0\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/9ba439de-33e3-4d79-b54a-8bf098e89f5f/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91076","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-91076","identifiers":["CVE-2026-91076"]},"retained":false,"historicalAffected":[]}],"coverage":[]}