CVE-2026-12584 describes a vulnerability in the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin where the plugin fails to verify the authenticity of payment-provider notifications before marking orders as paid. This insufficient verification (CWE-345) enables unauthenticated attackers to forge payment confirmation callbacks, effectively allowing them to complete orders without payment. The vulnerability affects versions prior to 7.0.2. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

An attacker can bypass payment verification and complete orders without paying, leading to financial loss for merchants using the affected plugin. The integrity of the payment process is compromised, but confidentiality and availability are not impacted according to the CVSS vector. The vulnerability requires no privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for a patch or update addressing this vulnerability. Until a fix is available, consider disabling the affected payment method or implementing additional verification controls if possible.