CVE-2026-16947

CVE-2026-16947 is an unauthenticated server-side request forgery (CWE-918) combined with missing response-authenticity verification in the Total Processing Card Payments for WooCommerce WordPress plugin, affecting all versions through 7.3. The plugin builds a server-side payment verification request from a user-supplied path without validating it, and does not verify that the response it receives genuinely comes from the payment gateway. An unauthenticated attacker can redirect that request to an arbitrary attacker-controlled host, causing the merchant's payment-gateway credentials to be disclosed, and can return a forged success response that marks arbitrary WooCommerce orders as paid without actual payment. Any WordPress/WooCommerce store running the affected versions is exposed, with no authentication or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade the plugin to a release newer than 7.3 as soon as the vendor publishes a fix (no fixed version number is available in the source data). Until patched, audit recent WooCommerce orders for transactions marked paid without a matching gateway payment, and treat stored Total Processing API credentials as potentially exposed, rotating them if compromise is suspected; a WAF rule restricting unauthenticated requests to the plugin's verification endpoint may reduce exposure.