WordPress Redsys Payment Gateway Plugin Vulnerable to Payment Forgery (CVE-2026-5050)

The Payment Gateway for Redsys & WooCommerce Lite plugin, a WordPress plugin enabling integration with Redsys, Bizum, and Google Pay payment gateways, contains a critical vulnerability (CVE-2026-5050) related to improper verification of cryptographic signatures. Specifically, the successful_request() handlers calculate a local signature but fail to validate the Ds_Signature parameter from the incoming request. This flaw, present in versions up to and including 7.0.0, allows an unauthenticated attacker with knowledge of a valid order key and amount to manipulate payment status. Successful exploitation results in orders being marked as paid without legitimate payment processing, potentially leading to financial loss for the merchant.

Attack Chain

1. Attacker identifies a WordPress site using the vulnerable Payment Gateway for Redsys & WooCommerce Lite plugin (version <= 7.0.0).
2. Attacker places an order on the targeted WooCommerce store, resulting in a pending order.
3. Attacker intercepts the order key and order amount associated with the pending order. This can be obtained via account enumeration.
4. Attacker crafts a malicious HTTP POST request to the WooCommerce payment callback endpoint (e.g., /wc-api/redsys). This request contains forged payment data, including a manipulated Ds_Signature parameter.
5. The crafted request spoofs a successful payment notification to the successful_request() handler in the vulnerable plugin.
6. The successful_request() handler calculates a local signature but does not validate the Ds_Signature parameter in the request.
7. The plugin incorrectly marks the pending order as "paid" within the WooCommerce system.
8. The order is processed, and the attacker receives the product or service without completing a legitimate payment.

Impact

Successful exploitation of CVE-2026-5050 allows unauthenticated attackers to bypass payment processes in WooCommerce stores using the vulnerable plugin. This can lead to significant financial losses for affected merchants due to the fulfillment of orders without actual payment. The vulnerability impacts any store running a vulnerable version of the plugin (<= 7.0.0) that uses the Redsys, Bizum, or Google Pay payment gateways. The CVSS v3.1 score is 7.5, indicating a high severity vulnerability.

Recommendation

• Immediately update the Payment Gateway for Redsys & WooCommerce Lite plugin to the latest version, which contains a fix for CVE-2026-5050.
• Monitor web server logs for suspicious POST requests to the WooCommerce payment callback endpoint (/wc-api/redsys) with unusual Ds_Signature values. Create a rule to detect POST requests to /wc-api/redsys with abnormally long or short Ds_Signature parameters.
• Implement stricter order verification processes in WooCommerce, including manual verification of payment status for suspicious orders.
• Deploy the Sigma rule to detect HTTP POST requests containing the vulnerable URI and a crafted Ds_Signature field.