Woo Redsys Gateway Light Vulnerabilities

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 7.0.1. This makes it possible for unauthenticated attackers to bypass payments.

CVSS:

5.3

Affected:

up to 7.0.1

Fixed in:

7.0.2

Disclosed:

Jul 29, 2026

CVE-2026-12584 on NVD →

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.0.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 7.0.0

Fixed in:

7.0.1

Disclosed:

Apr 16, 2026

CVE-2026-40741 on NVD →

The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successful_request() handlers calculating a local signature but not validating Ds_Signature from the request before accepting payment st...

CVSS:

7.5

Affected:

up to 7.0.0

Fixed in:

7.0.1

Disclosed:

Apr 15, 2026

CVE-2026-5050 on NVD →