Robokassa CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Robokassa CVE published 2026-10-14

CVE-2026-91076

The Robokassa payment gateway for WooCommerce plugin before version 1.9.0 does not verify the authenticity of incoming payment-notification requests, allowing unauthenticated attackers to change any WooCommerce order status to failed. This vulnerability affects WooCommerce installations using the Robokassa payment gateway, potentially disrupting order fulfillment processes. Order identifiers are sequentia [truncated]

LOW Robokassa CVE published 2026-09-17

CVE-2026-91017

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.