CVE-2026-91076: Unknown Robokassa Payment Gateway For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

Affected products

• Unknown Robokassa Payment Gateway For Woocommerce: before 1.9.0 (fixed in 1.9.0)

Published 2026-10-14. Last modified 2026-10-15.