CVE-2026-6939 corvusinfo CVE debrief

Who should care

Users of the CorvusPay WooCommerce Payment Gateway plugin for WordPress should be aware of this vulnerability and take steps to protect their sites. This includes updating the plugin to a version that fixes the vulnerability, implementing additional security measures such as input validation and output encoding, and monitoring for suspicious activity on their WordPress site. Site administrators and security teams should review the vulnerability details and assess the potential impact on their organization.

Technical summary

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability has a CVSS score of 7.2 and is considered High severity. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.

Defensive priority

High priority given the CVSS score of 7.2 and the potential for unauthenticated attackers to inject malicious scripts.

Recommended defensive actions

• Update the CorvusPay WooCommerce Payment Gateway plugin to a version that fixes the vulnerability
• Implement additional security measures such as input validation and output encoding
• Monitor for suspicious activity on your WordPress site
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-11T07:16:46.787Z and has not been modified since. The NVD entry is currently Received. There is limited information available about the specific details of the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Official resources