PT-2026-6018 · Automattic+1 · Woocommerce+1

Md. Moniruzzaman Prodhan + 1 · Publicado 2026-02-04 · Atualizado 2026-02-04 · CVE-2026-0679

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortis for WooCommerce versions up to and including 1.2.0

Description The Fortis for WooCommerce plugin for WordPress has an authorization bypass issue because of an incorrect nonce check within the check fortis notify response function. This allows unauthenticated attackers to modify WooCommerce order statuses to paid, processing, or completed, potentially enabling fraudulent order marking as paid without actual payment. The issue affects the wc-api endpoint.

Recommendations Update Fortis for WooCommerce to a version later than 1.2.0.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0679

Produtos afetados

Fortis For Woocommerce

Woocommerce

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0679 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457351%40fortis-for-woocommerce&new=3457351%40fortis-for-woocommerce&sfp_email=&sfph_mail= · Nota
• https://t.me/CVEtracker/43706 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/fortis-for-woocommerce/trunk/classes/WC_Gateway_Fortis.php#L1674 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/9f16c098-3e99-4506-b517-ae4b838a0925?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/fortis-for-woocommerce/tags/1.2.0/classes/WC_Gateway_Fortis.php#L1674 · Nota