Improper Signature Verification Vulnerability in Payment Gateway for Redsys and WooCommerce Lite Plugin

CVE-2026-5050

What is CVE-2026-5050?

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress contains a vulnerability that allows unauthenticated attackers to manipulate payment statuses. Specifically, the plugin fails to properly validate the Ds_Signature from incoming requests during successful_request() handling. This deficiency enables attackers to forge payment callback data, which can lead to unauthorized orders being marked as paid without the appropriate payment being processed. This vulnerability affects versions up to and including 7.0.0 and poses a significant risk to e-commerce operations utilizing this plugin with payment systems such as Redsys, Bizum, and Google Pay.

References