CVE-2026-12584

Name of the Vulnerable Software and Affected Versions Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions prior to 7.0.2

Description The plugin fails to verify the authenticity of incoming payment-provider notifications for a specific payment method before marking orders as paid. This allows unauthenticated attackers to forge a payment-confirmation callback to complete orders without performing the actual payment.

Recommendations Update the plugin to version 7.0.2 or later.