CVE-2026-12584: Unknown Payment Gateway For Redsys & Woocommerce Lite

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.

Affected products

• Unknown Payment Gateway For Redsys & Woocommerce Lite: before 7.0.2 (fixed in 7.0.2)

Published 2026-08-06. Last modified 2026-08-26.