Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successful_request() handlers calculating a local signature but not validating Ds_Signature from the request before accepting payment status across the Redsys, Bizum, and Google Pay gateway flows. This makes it possible for unauthenticated attackers to forge payment callback data and mark pending orders as paid when they know a valid order key and order amount, potentially allowing checkout completion and product or service fulfillment without a successful payment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-5050 Improper Cryptographic Signature Verification in Payment Gateway for Redsys & WooCommerce Lite https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5050
Post summary
The post references CVE-2026-5050 as an improper cryptographic signature verification flaw in Redsys & WooCommerce Lite, but offers no further details such as PoC, exploitation or patch information.
CVE-2026-5050 The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and includin… https://www.cve.org/CVERecord?id=CVE-2026-5050
Post summary
The passage announces CVE‑2026‑5050, a vulnerability in the Redsys & WooCommerce Lite plugin identified as an improper verification of a cryptographic signature, without providing proof of exploitation, tools, or remediation.
⚠️ HIGH — CVE-2026-5050 The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Crypto… CVSS 7.5 Full analysis → https://sec.kaitan.id/cves/CVE-2026-5050 #WordPress #CyberSecurity #InfoSec
Post summary
A new vulnerability (CVE‑2026‑5050) affecting the Redsys and WooCommerce Lite plugins has been disclosed, noting improper cryptographic verification and a CVSS score of 7.5, with no PoC, exploit, or patch details provided.