Executive Summary
CVE-2026-16947 affects the Total processing card payments for WooCommerce plugin (versions through 7.3) and carries a CVSS score of 9.1. The plugin builds a server-side payment-verification request using a user-supplied path that is never validated, and it does not check that the response it receives actually came from the expected payment gateway. That combination lets an unauthenticated attacker redirect the verification request to a server they control and return a forged "success" response — potentially allowing orders to be marked as paid without a legitimate transaction, and exposing the store's outbound verification request (which may carry gateway credentials) to an attacker-controlled endpoint.
CVSS Score: 9.1 (Critical)
There is no patched version available as of this advisory.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-16947 |
| CVSS Score | 9.1 (Critical) |
| Type | Server-Side Request Forgery (SSRF) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Root Cause | Unvalidated user-supplied path used in server-side verification request; response authenticity not checked |
Affected Versions
| Product | Affected Versions | Recommendation |
|---|---|---|
| Total processing card payments for WooCommerce | All versions through 7.3 | No fix available — disable the plugin or restrict outbound requests until patched |
Technical Details
The plugin's checkout flow performs a server-side call to verify that a card payment was actually approved by the payment gateway before marking a WooCommerce order as paid. Two separate flaws combine to break that trust boundary:
- Unvalidated destination path. The path used to build the outbound verification request is taken from user-controllable input without being checked against an allowlist of legitimate gateway endpoints — the classic ingredient for SSRF.
- No response authenticity check. After the request is sent, the plugin does not verify that the response actually originated from the real payment gateway (e.g. no signature or shared-secret validation) — it simply trusts whatever comes back.
Chained together, an attacker can point the verification request at a server they control and return a fabricated "payment approved" response, all without needing an account on the store. Because the request is issued from the store's own server, this also exposes the request's headers and payload — potentially including gateway API keys or merchant identifiers — to whatever endpoint the attacker directs it toward, in addition to any internal-network reconnaissance an SSRF vector on a hosting server normally enables.
Attack Vector
1. Attacker submits a checkout request that manipulates the verification path
2. Store server builds a payment-verification call using the attacker-supplied path
3. Request is sent to the attacker-controlled destination instead of the real gateway
4. Attacker's server returns a forged "approved" response
5. Plugin accepts the response without checking its authenticity
6. Order is marked as paid without an actual successful transactionImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Payment Fraud | Orders can be marked "paid" without a genuine transaction, resulting in direct financial loss |
| Credential/Data Exposure | Outbound verification requests directed to attacker infrastructure may leak gateway credentials or request metadata |
| Internal Network Probing | SSRF from the store's server can be used to probe internal services reachable from the hosting environment |
| No Authentication Needed | Exploitation requires no account and no user interaction from store staff |
Immediate Remediation
Step 1: Check Exposure
wp plugin list --status=active | grep -i "totalprocessing\|total-processing\|total processing"Step 2: Mitigate Until Patched
Because no fixed version currently exists:
- Deactivate the plugin if the store cannot tolerate forged-payment risk, and process card payments through an alternative verified gateway integration in the meantime.
- Audit recent orders marked as paid for ones lacking a corresponding legitimate transaction in the actual payment gateway's dashboard.
- Restrict outbound server requests at the hosting/firewall level to an allowlist of known payment-gateway hostnames if the plugin must remain active temporarily.
If Immediate Removal Is Not Possible
- Monitor order status changes against the payment gateway's own transaction records for mismatches.
- Flag and manually verify any order marked "paid" without a matching gateway transaction ID before fulfillment.
- Rotate any gateway API credentials that may have been exposed via forged verification traffic.
Detection Indicators
| Indicator | Description |
|---|---|
| Orders marked paid with no matching transaction in the gateway dashboard | Direct sign of exploitation |
| Outbound verification requests to unfamiliar hostnames in server logs | Evidence of SSRF redirection |
| Spikes in checkout attempts with malformed or unusual path parameters | Possible exploitation attempts in progress |
Post-Remediation Steps
- Reconcile all "paid" orders against actual gateway transaction records since the plugin was installed.
- Rotate payment gateway credentials if exposure to attacker-controlled infrastructure cannot be ruled out.
- Restrict outbound requests from the store server to only the payment gateway's known endpoints.
- Track NVD/WPScan for a patched release before re-enabling full functionality.