CVE-2026-5050
Improper Signature Verification in Redsys WooCommerce Plugin Allows Payment Forgery
Publication date: 2026-04-16
Last updated on: 2026-04-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| woocommerce | payment_gateway_for_redsys_lite | to 7.0.0 (inc) |
| woothemes | woocommerce_lite | to 7.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress has a vulnerability in versions up to and including 7.0.0 where it improperly verifies cryptographic signatures.
Specifically, the successful_request() handlers calculate a local signature but do not validate the Ds_Signature from the incoming request before accepting the payment status.
This flaw affects the Redsys, Bizum, and Google Pay gateway flows, allowing unauthenticated attackers who know a valid order key and order amount to forge payment callback data.
As a result, attackers can mark pending orders as paid without actually completing a successful payment.
How can this vulnerability impact me? :
This vulnerability can allow attackers to complete checkout processes and receive products or services without making a legitimate payment.
Since attackers can forge payment callback data and mark orders as paid, it can lead to financial losses and unauthorized fulfillment of goods or services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to forge payment callback data and mark pending orders as paid without successful payment verification.
This could lead to unauthorized product or service fulfillment, potentially resulting in financial discrepancies and unauthorized transactions.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, such unauthorized transactions and data manipulation could raise concerns regarding data integrity and transaction authenticity, which are important for regulatory compliance.
However, no direct impact on personal data protection or health information is described, so specific effects on GDPR or HIPAA compliance cannot be confirmed from the given data.