EUVD-2026-54304
GHSA-9f34-8wwr-2wjq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Callback endpoint is publicly reachable with no authentication; forging a notification requires no elevated privileges and achieves high integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.
AnalysisAI
Payment bypass in Payment Gateway for Redsys & WooCommerce Lite before version 7.0.2 allows unauthenticated remote attackers to complete WooCommerce orders without actual payment by forging payment-provider callback notifications. The plugin fails to cryptographically verify the authenticity of inbound payment confirmations for at least one of its payment methods, meaning any actor who can reach the callback endpoint can submit a fabricated notification and have orders marked as paid. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires only network access and minimal technical skill.
Technical ContextAI
The affected product is a WordPress plugin that integrates WooCommerce with Redsys, a widely-used Spanish card-payment processing network. Payment gateways of this type receive asynchronous server-to-server notifications (commonly called IPN callbacks or response notifications) from the payment provider to confirm transaction outcomes. Proper implementation requires verifying an HMAC signature or shared-secret field included in the notification before acting on it. The root cause here - while no CWE was formally assigned - maps to CWE-345 (Insufficient Verification of Data Authenticity): the plugin processes the notification and updates order status without confirming the message originated from Redsys. The WPScan advisory (https://wpscan.com/vulnerability/1ff08062-8f2c-4542-b795-fe82bfa6040c/) is the primary reference; no CPE strings were provided in the input data.
RemediationAI
Upgrade the Payment Gateway for Redsys & WooCommerce Lite plugin to version 7.0.2 or later, which is the vendor-released patched version per the WPScan advisory at https://wpscan.com/vulnerability/1ff08062-8f2c-4542-b795-fe82bfa6040c/. Site administrators should apply this update immediately via the WordPress admin dashboard or WP-CLI. If immediate upgrade is not possible, a temporary compensating control is to disable the specific payment method affected (the one lacking notification verification) within the plugin settings, directing customers to an alternative payment method - though this has the trade-off of reducing checkout options. Restricting access to the payment callback endpoint by IP allowlist (to known Redsys server IP ranges) at the web server or WAF layer is a viable short-term measure but requires knowledge of Redsys's egress IP ranges and may break legitimate notifications if those ranges change. No side-channel patch or configuration flag is known beyond disabling the affected method or upgrading.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today