PT-2026-6018 · Automattic+1 · Woocommerce+1

Md. Moniruzzaman Prodhan + 1 · Published 2026-02-04 · Updated 2026-02-04 · CVE-2026-0679

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortis for WooCommerce versions up to and including 1.2.0

Description The Fortis for WooCommerce plugin for WordPress has an authorization bypass issue because of an incorrect nonce check within the check fortis notify response function. This allows unauthenticated attackers to modify WooCommerce order statuses to paid, processing, or completed, potentially enabling fraudulent order marking as paid without actual payment. The issue affects the wc-api endpoint.

Recommendations Update Fortis for WooCommerce to a version later than 1.2.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0679

Affected Products

Fortis For Woocommerce

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0679 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457351%40fortis-for-woocommerce&new=3457351%40fortis-for-woocommerce&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/43706 · Telegram Post
• https://plugins.trac.wordpress.org/browser/fortis-for-woocommerce/trunk/classes/WC_Gateway_Fortis.php#L1674 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9f16c098-3e99-4506-b517-ae4b838a0925?source=cve · Note
• https://plugins.trac.wordpress.org/browser/fortis-for-woocommerce/tags/1.2.0/classes/WC_Gateway_Fortis.php#L1674 · Note