Unvalidated Path Leads to Payment Gateway Credential Theft

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability in the Total processing card payments WooCommerce plugin exposes a Server-Side Request Forgery (SSRF) flaw that allows unauthenticated attackers to intercept sensitive payment data. The plugin fails to validate user-supplied paths before constructing server-side verification requests to payment gateways, and critically, does not verify the authenticity of responses. This means attackers can redirect legitimate payment verification requests to attacker-controlled hosts, capturing merchant payment gateway credentials in transit. Additionally, attackers can forge success responses to mark arbitrary orders as paid without actual payment, leading to financial fraud. Any WordPress site running WooCommerce with this plugin enabled is at risk, affecting e-commerce merchants of all sizes who depend on this popular payment processing solution.

Casky's 331 mapped skills detect the attack patterns underlying this vulnerability by correlating reconnaissance (TA0001) and resource development (TA0006) techniques with SSRF indicators. Practitioners using Casky would identify findings showing: (1) unexpected outbound connections to non-standard hosts during payment verification workflows, flagging the path redirection; (2) suspicious parameter manipulation in payment request URLs where attacker-controlled paths are injected; (3) response validation gaps where forged payment confirmations bypass authentication checks; and (4) lateral movement patterns where captured credentials are used to access payment gateway APIs. Claude's extended reasoning enables Casky to correlate these signals across request/response pairs and credential usage patterns, surfacing the complete attack chain from initial SSRF exploitation through credential theft and order fraud in a single integrated finding.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16947.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-16947

Casky has 331 skills that investigate the attack patterns behind CVE-2026-16947. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn