CVE-2026-40741: Unauthenticated Broken Access Control in Redsys for WooCommerce Light

Technical summary

CVE-2026-40741 is an unauthenticated broken access control vulnerability classified under CWE-862 (Missing Authorization). The flaw permits an attacker to bypass authentication and authorization checks within the Redsys payment gateway integration for WooCommerce Light. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH severity) with a network-accessible attack vector, no required privileges, and low attack complexity. The integrity impact is HIGH while confidentiality and availability remain unaffected. This indicates that while data cannot be read or system availability compromised directly through this vector, an attacker can make unauthorized modifications to protected resources.

Business impact

WooCommerce stores using Redsys for payment processing face significant operational and financial risk. Attackers can modify order status, payment records, or transaction details without detection barriers, potentially leading to unauthorized refunds, order fulfillment fraud, or manipulation of payment amounts. For merchants and payment processors relying on the integrity of transaction records for reconciliation and reporting, this creates audit complications and customer trust erosion. Depending on the scope of modification, this could also trigger disputes with payment networks and regulatory scrutiny around transaction tampering.

Affected systems

The vulnerability affects Redsys for WooCommerce Light plugin versions 7.0.0 and earlier. Any WordPress installation running WooCommerce with this plugin version is at risk if the site is internet-facing. The issue does not appear to be vendor-disclosed as a multi-product flaw; exposure is specific to this integration extension.

Exploitability

The vulnerability scores high on exploitability metrics: network-accessible (AV:N), no authentication required (PR:N), no user interaction needed (UI:N), and low attack complexity (AC:L). An attacker requires only network access and knowledge of the vulnerable endpoint to trigger the flaw. No specialized credentials, social engineering, or user action is necessary. This combination makes the vulnerability straightforward to exploit at scale, particularly for threat actors conducting opportunistic scans of e-commerce infrastructure.

Remediation

Organizations must update Redsys for WooCommerce Light to a version newer than 7.0.0 where this flaw has been patched. Before patch deployment, apply compensating controls such as Web Application Firewall (WAF) rules to block requests targeting the vulnerable endpoints, restrict plugin admin access to known IP ranges, or temporarily disable the plugin if payment processing can be redirected through alternative channels. Verify the patch version against the official Redsys and WooCommerce plugin repositories before applying.

Patch guidance

Update the Redsys for WooCommerce Light plugin to the first available version released after 7.0.0. Consult the official WooCommerce plugin marketplace and Redsys release notes to confirm the patch version. Test the update in a staging environment to verify payment functionality remains intact and that the access control validation is now enforced. After deployment, verify no database inconsistencies exist in order records from the vulnerability window by running reconciliation reports against payment gateway logs.

Detection guidance

Monitor for anomalous modification requests to WooCommerce order endpoints, particularly POST or PUT requests originating from unauthenticated sessions that succeed in modifying order metadata, payment status, or transaction amounts. Audit logs should flag any changes to protected order fields without corresponding user authentication records. WAF and API gateway logs are valuable for identifying patterns of probing or exploitation attempts targeting the Redsys integration. Review transaction reconciliation reports for unexplained order status changes or refund records that lack corresponding customer actions.

Why prioritize this

Despite the lack of KEV listing, this vulnerability merits immediate remediation priority due to its HIGH CVSS score, zero authentication requirement, and direct impact on financial transaction integrity. E-commerce platforms are high-value targets, and the ability to modify orders or payment records without authentication creates immediate business risk. The low attack complexity means exploitation requires minimal sophistication, increasing the likelihood of active exploitation by opportunistic attackers.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects the HIGH severity classification. The network attack vector and absence of any privilege or authentication requirements elevate exploitability. The HIGH integrity impact captures the ability to modify critical transactional data. Confidentiality and availability impacts are rated as NONE because the vulnerability does not enable data exfiltration or denial of service; the attack is focused on unauthorized modification. The combination of easy exploitability and direct harm to business-critical transactions justifies the HIGH rating.

Frequently asked questions