What the vulnerability does
01Description
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successful_request() handlers calculating a local signature but not validating Ds_Signature from the request before accepting payment status across the Redsys, Bizum, and Google Pay gateway flows. This makes it possible for unauthenticated attackers to forge payment callback data and mark pending orders as paid when they know a valid order key and order amount, potentially allowing checkout completion and product or service fulfillment without a successful payment.
Explanation of Vulnerability in Simple Terms
02Summary
The Payment Gateway for Redsys & WooCommerce Lite plugin contains an integrity vulnerability that allows attackers to modify data in transit without authentication. An attacker on the network can intercept and alter payment or transaction information. This affects all versions up to 7.0.0. Site owners should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Modify payment or transaction data in transit without authentication.
Potential impact on your site
04Site Impact
Payment transactions or sensitive data could be altered by attackers, potentially causing financial loss or data corruption.
Conditions required to exploit
05Prerequisites
Network access to intercept traffic; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 16, 2026
CVE published
April 16, 2026
Record updated
