Jwt Attack EUVD-2026-23194

Requires the Payment Gateway for Redsys & WooCommerce Lite plugin (version ≤7.0.0) actively installed and enabled on a WordPress/WooCommerce site with at least one of the three payment gateways configured (Redsys, Bizum, or Google Pay). Attacker must obtain two pieces of order-specific data: a valid order key (WordPress WooCommerce generates predictable or sequential keys, often exposed in URLs like /checkout/order-received/123/?key=wc_order_ABC123XYZ) and the exact order amount. Order keys are frequently leaked through confirmation emails to attacker-controlled addresses during reconnaissance purchases, referrer headers, or publicly accessible order status pages. Order amounts are visible during checkout before payment submission. No authentication required (PR:N) - the vulnerability exists in unauthenticated payment callback handlers that external payment gateways invoke. No special WordPress configuration needed beyond plugin activation. Exploitation is NOT limited by user interaction (UI:N), network segmentation (AV:N allows internet-based attacks), or technical complexity (AC:L). The primary limiting factor is order-specific data acquisition, but this is a reconnaissance problem, not a technical barrier. Sites with predictable order numbering schemes or information disclosure issues in order confirmation flows are at elevated risk.

Real-world risk is HIGH despite no confirmed active exploitation. CVSS 7.5 (High severity) with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation requiring no authentication, low complexity, and no user interaction - attackers need only network access to the WordPress site. The attack complexity is genuinely low because the required prerequisites (order key and amount) are often discoverable: order keys may appear in confirmation emails sent to attacker-controlled addresses during reconnaissance, and order amounts are visible during checkout before payment. Scope is Unchanged (S:U) but Integrity impact is High (I:H) - attackers achieve complete bypass of payment verification, directly undermining business logic. Not listed in CISA KEV and no public POC identified, suggesting no widespread exploitation yet, but the technical barrier is minimal for motivated attackers targeting e-commerce sites. The WordPress plugin ecosystem's broad deployment surface increases exposure. SSVC framework assessment: Exploitation=none (per available data), Automatable=yes (callback forgery is scriptable once order details obtained), Technical Impact=total (complete payment bypass within WooCommerce order flow). This is a prioritize-now vulnerability for any site using affected plugin versions in production, as financial impact is direct and immediate.

Attacker initiates legitimate checkout on target WooCommerce site to obtain a valid order key (often visible in browser URLs or confirmation emails) and observes the order amount. Using this information, attacker crafts a malicious HTTP POST request to the plugin's payment callback endpoint, mimicking the structure of legitimate Redsys/Bizum/Google Pay gateway responses. The forged request includes the captured order key, order amount, and fabricated Ds_Signature value (which the plugin fails to validate). The vulnerable successful_request() handler accepts this data without verification, updating the WooCommerce order status from 'pending payment' to 'processing' or 'completed', triggering automated fulfillment workflows for digital goods, shipping labels for physical products, or service provisioning.