CyberRota Analysis
AI-GeneratedThe Robokassa payment gateway for WooCommerce plugin prior to version 1.8.9 is vulnerable due to its failure to authenticate incoming payment notifications when the deferred-payment feature is enabled. This allows unauthenticated attackers to manipulate order statuses, potentially marking them as paid or on-hold without legitimate payment confirmation. WooCommerce store operators using this plugin should prioritize updating to mitigate the risk of fraudulent transactions.
Original NVD Description
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.