CVE-2026-5050
Received Received - Intake
Improper Signature Verification in Redsys WooCommerce Plugin Allows Payment Forgery

Publication date: 2026-04-16

Last updated on: 2026-04-16

Assigner: Wordfence

Description
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successful_request() handlers calculating a local signature but not validating Ds_Signature from the request before accepting payment status across the Redsys, Bizum, and Google Pay gateway flows. This makes it possible for unauthenticated attackers to forge payment callback data and mark pending orders as paid when they know a valid order key and order amount, potentially allowing checkout completion and product or service fulfillment without a successful payment.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-16
Last Modified
2026-04-16
Generated
2026-05-06
AI Q&A
2026-04-16
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
woocommerce payment_gateway_for_redsys_lite to 7.0.0 (inc)
woothemes woocommerce_lite to 7.0.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress has a vulnerability in versions up to and including 7.0.0 where it improperly verifies cryptographic signatures.

Specifically, the successful_request() handlers calculate a local signature but do not validate the Ds_Signature from the incoming request before accepting the payment status.

This flaw affects the Redsys, Bizum, and Google Pay gateway flows, allowing unauthenticated attackers who know a valid order key and order amount to forge payment callback data.

As a result, attackers can mark pending orders as paid without actually completing a successful payment.


How can this vulnerability impact me? :

This vulnerability can allow attackers to complete checkout processes and receive products or services without making a legitimate payment.

Since attackers can forge payment callback data and mark orders as paid, it can lead to financial losses and unauthorized fulfillment of goods or services.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability allows unauthenticated attackers to forge payment callback data and mark pending orders as paid without successful payment verification.

This could lead to unauthorized product or service fulfillment, potentially resulting in financial discrepancies and unauthorized transactions.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, such unauthorized transactions and data manipulation could raise concerns regarding data integrity and transaction authenticity, which are important for regulatory compliance.

However, no direct impact on personal data protection or health information is described, so specific effects on GDPR or HIPAA compliance cannot be confirmed from the given data.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart