Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order statuses to paid/processing/completed, effectively allowing them to mark orders as paid without payment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-0679 The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in a… https://www.cve.org/CVERecord?id=CVE-2026-0679
Post summary
The entry announces a WordPress plugin flaw (Fortis for WooCommerce) that permits authorization bypass via an inverted nonce check, providing basic technical details and linking to the CVE record.
CVE-2026-0679 Authorization Bypass in Fortis for WooCommerce Plugin Enables Order Status Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0679
Post summary
The post announces a new authorization bypass vulnerability (CVE‑2026‑0679) in the Fortis for WooCommerce plugin that allows attackers to manipulate order status.