CVE-2026-12584 affects the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin prior to version 7.0.2. The plugin fails to properly verify the authenticity of payment-provider notifications for one of its payment methods. This insufficient verification allows unauthenticated attackers to forge payment-confirmation callbacks, thereby completing orders without paying. The vulnerability is categorized under CWE-345 and has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating that the attack can be performed remotely with low complexity and no privileges or user interaction, resulting in high impact on integrity but no impact on confidentiality or availability.

An attacker can exploit this vulnerability to forge payment confirmation callbacks, causing the system to mark orders as paid without actual payment. This leads to unauthorized order completion and potential financial loss for merchants using the affected plugin versions.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider disabling or replacing the affected payment method to prevent exploitation.