CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.
Explanation of Vulnerability in Simple Terms
A vulnerability in Payment Gateway for Redsys & WooCommerce Lite versions before 7.0.2 allows an attacker to modify payment transaction data without authentication. The flaw stems from insufficient input validation on payment parameters. An attacker can intercept and alter transaction details during processing, potentially changing payment amounts or recipient accounts. Site owners should update immediately to version 7.0.2 or later.
What an attacker can do
Modify payment transaction data, including amounts or recipient accounts, without authentication.
Potential impact on your site
Attackers can alter WooCommerce payment transactions, leading to financial loss or fraud.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
