CVE-2026-5050 describes a cryptographic signature verification weakness (CWE-347) in the Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions up to 7.0.0. The vulnerability arises because the plugin's successful_request() handlers do not validate the Ds_Signature field from payment gateway callbacks, despite calculating a local signature. This improper verification enables attackers to forge payment callback data and change order statuses to paid without legitimate payment confirmation. The issue affects Redsys, Bizum, and Google Pay gateway flows within the plugin.

An attacker with knowledge of a valid order key and order amount can exploit this vulnerability to mark pending orders as paid without completing an actual payment transaction. This can result in unauthorized checkout completions and the fulfillment of products or services without financial exchange, causing direct financial loss to merchants using the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, users should consider disabling the affected payment gateway plugin or implementing additional verification controls outside the plugin to validate payment callbacks. Monitor vendor channels for updates and apply official fixes promptly once released.