Vulnerability in Jconti Payment Gateway For Redsys & Woocommerce Lite
CVE-2026-5050
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successful_request() handlers calculating a local signature but not validating Ds_Signature from the request before accepting payment status across the Redsys, Bizum, and Google Pay gateway flows. This makes it possible for unauthenticated attackers to forge payment callback data and mark pending orders as paid when they know a valid order key and order amount, potentially allowing checkout completion and product or service fulfillment without a successful payment.
EPSS: 0.002 (10.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Jconti Payment Gateway For Redsys & Woocommerce Lite — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2026-5050?
- CVE-2026-5050 is a high-severity vulnerability in Jconti Payment Gateway For Redsys & Woocommerce Lite, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.5/10. Published 2026-04-16.
- How severe is CVE-2026-5050?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2026-5050 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.