CVE-2026-91076 Robokassa CVE debrief

Who should care

Defenders responsible for WooCommerce installations using the Robokassa payment gateway should assess exposure and prioritize updates to prevent unauthorized order status changes. This includes WooCommerce administrators, security teams, and IT personnel who manage WooCommerce installations. Additionally, operators and platform administrators who manage affected systems should also be aware of the vulnerability and take necessary precautions to prevent its

Why it matters

The vulnerability allows unauthenticated attackers to change any WooCommerce order status to failed, potentially disrupting order fulfillment processes and impacting customer satisfaction.

• Potential disruption to order fulfillment processes
• Possible impact on customer satisfaction and revenue
• Need for verification of order status changes
• Potential for reputational damage due to failed orders

Technical summary

The Robokassa payment gateway for WooCommerce plugin before version 1.9.0 does not verify the authenticity of incoming payment-notification requests, allowing unauthenticated attackers to change any WooCommerce order status to failed. This vulnerability is caused by a lack of authentication and authorization in the payment gateway, which allows attackers to manipulate order status without any restrictions. The vulnerability affects WooCommerce installations using the Robokassa payment gateway and has a significant impact on the security of these installations.

Defensive priority

Defenders should prioritize updating the Robokassa payment gateway for WooCommerce plugin to version 1.9.0 or later to prevent unauthorized order status changes.

Recommended defensive actions

• Update the Robokassa payment gateway for WooCommerce plugin to version 1.9.0 or later
• Verify the authenticity of incoming payment-notification requests
• Monitor for suspicious order status changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, additional information from other sources may be necessary to fully assess the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.