Description

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:45.333Z",
  "pubdate": "2026-08-06T22:16:45.333Z",
  "executiveSummary": "An improper validation of cryptographic signatures or authenticity checks exists within the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before version 7.0.2.\nThe vulnerability allows unauthenticated remote attackers to forge payment-confirmation callbacks and manipulate transaction states.\nThe primary impact of this security flaw is unauthorized financial bypass, enabling malicious actors to complete e-commerce orders without rendering actual payment.\nThe affected product is the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin for versions preceding 7.0.2.\nThe risk implications are severe for merchants utilizing the vulnerable payment method, as it leads to direct financial loss and inventory depletion via automated exploitation.\nAttacker capabilities are restricted to crafting and transmitting malicious Hypertext Transfer Protocol (HTTP) requests directly to the callback endpoint.\nExploitation requirements include network accessibility to the target WordPress installation and knowledge of the vulnerable payment notification endpoint structure, without requiring any prior authentication, privileges, or valid cryptographic parameters.",
  "technicalDetails": "The root cause of the vulnerability resides in the payment-provider notification processing logic within the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin.\nSpecifically, the affected payment method handler fails to cryptographically verify or authenticate incoming webhook or callback requests dispatched by the payment provider before trusting the payload contents.\nThe vulnerable component is the notification listener endpoint responsible for processing asynchronous transaction status updates.\nThe affected software versions encompass all releases of the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin prior to version 7.0.2.\nAuthentication requirements are entirely absent, permitting unauthenticated external entities to interact directly with the callback handler.\nPrivilege requirements are non-existent, as the endpoint is exposed publicly to handle external notifications from the payment gateway infrastructure.\nNetwork exposure is fully public via standard web protocols (HTTP/HTTPS), allowing any remote actor on the internet to dispatch crafted payloads to the vulnerable script.\nThe attack flow proceeds as follows: First, an unauthenticated attacker initiates a standard checkout process on a WooCommerce store utilizing the vulnerable Redsys payment method to generate a valid target order identifier. Second, instead of proceeding to the legitimate payment gateway interface to complete financial settlement, the attacker constructs a forged HTTP POST or GET request simulating a successful payment-confirmation callback from the payment provider. Third, the attacker transmits this crafted request directly to the unsecured notification handler endpoint of the target WordPress site. Fourth, because the vulnerable plugin logic lacks proper authenticity checks, signature validation, or token verification, it accepts the unauthenticated notification as legitimate. Fifth, the application updates the corresponding WooCommerce order status from pending to paid or processing. Sixth, the e-commerce system triggers post-order routines, such as digital delivery or physical fulfillment preparation, allowing the attacker to successfully acquire goods or services without executing a valid financial transaction.\nThe post-exploitation impact includes unauthorized acquisition of merchandise, financial fraud, and potential supply chain or inventory discrepancies for the merchant."
}