CVE-2026-91017: Unknown Robokassa Payment Gateway For Woocommerce

Low severity, CVSS 3.7. EPSS: 0.1% chance of exploitation in the next 30 days.

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

Affected products

• Unknown Robokassa Payment Gateway For Woocommerce: before 1.8.9 (fixed in 1.8.9)

Published 2026-09-17. Last modified 2026-09-18.