THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-16947 (CRITICAL 9.1) — The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect

[NVD] CVE-2026-16947 (CRITICAL 9.1) — The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect

mednvdPublished 2026-08-29

CVE-2026-16947 CVSS: 9.1 CRITICAL Published: 2026-08-29T06:17:05.583

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-16947cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16947