The plugin contains a flaw where the callback handler calculates a local cryptographic signature but fails to verify the Ds_Signature provided in the request. This allows an attacker who can guess a valid order key and amount to forge callback data that marks a pending order as paid, potentially enabling the completion of checkout and delivery of products or services without a legitimate payment. The weakness is a classic cryptographic signature verification failure (CWE-347).

WordPress sites using the Payment Gateway for Redsys & WooCommerce Lite plugin in any version up to and including 7.0.0 are affected. Users of older WordPress installations that employ this plugin should check their installed version; any deployment using 7.0.0 or earlier is vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability. An EPSS score is not available, so the likelihood of exploitation cannot be quantified here. The attack can be performed remotely by sending a crafted HTTP request to the payment callback endpoint; no authentication is required. The vulnerability is not listed in the CISA KEV catalog, but its impact on financial transactions makes it a priority for remediation. Without proper cryptographic signature validation, attackers can impersonate the payment gateway’s response to the e‑commerce platform, turning unpaid orders into paid ones.