An unauthenticated vulnerability in the Payment Gateway for Redsys & WooCommerce Lite plugin allows attackers to manipulate payment status, potentially enabling fraudulent order fulfillment.

This flaw involves improper verification of cryptographic signatures within the plugin, where the successful_request handler fails to validate the Ds_Signature parameter. This allows an unauthenticated attacker to inject forged payment callback data and mark orders as paid without an actual transaction.

Successful exploitation of this vulnerability directly impacts revenue and inventory management by allowing unauthorized checkout completion. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to e-commerce operations, as it facilitates the theft of goods or services through payment bypass.

Immediate Action: Administrators should immediately audit all processed orders for suspicious payment statuses and confirm that the plugin is updated to the latest available version if a fix has been released. If no update is available, consider disabling the plugin or switching to an alternative payment gateway until a secure version is provided.

Proactive Monitoring: Monitor server access logs for anomalous callback requests directed at the payment gateway endpoints, specifically looking for high frequencies of requests from unexpected sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious or malformed POST requests targeting payment gateway callback URLs.

Public Exploit Available: No (exploit_available: false).

This vulnerability represents a critical risk to business financial integrity and must be addressed with high priority. Organizations using this plugin should immediately verify if a patch is available via the WordPress repository or the vendor, and ensure that all payment logs are reviewed for evidence of past unauthorized activity.