Executive Summary

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress has a vulnerability in versions up to and including 7.0.0 where it improperly verifies cryptographic signatures.

Specifically, the successful_request() handlers calculate a local signature but do not validate the Ds_Signature from the incoming request before accepting the payment status.

This flaw affects the Redsys, Bizum, and Google Pay gateway flows, allowing unauthenticated attackers who know a valid order key and order amount to forge payment callback data.

As a result, attackers can mark pending orders as paid without actually completing a successful payment.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to complete checkout processes and receive products or services without making a legitimate payment.

Since attackers can forge payment callback data and mark orders as paid, it can lead to financial losses and unauthorized fulfillment of goods or services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to forge payment callback data and mark pending orders as paid without successful payment verification.

This could lead to unauthorized product or service fulfillment, potentially resulting in financial discrepancies and unauthorized transactions.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, such unauthorized transactions and data manipulation could raise concerns regarding data integrity and transaction authenticity, which are important for regulatory compliance.

However, no direct impact on personal data protection or health information is described, so specific effects on GDPR or HIPAA compliance cannot be confirmed from the given data.

Useful 0 Not Useful 0